General Info Watch the FULL Interactive Analysis at ANY.RUN!

File name

____________.js.zip

Verdict
Malicious activity
Analysis date
12/6/2018, 03:42:12
OS:
Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
gandcrab
trojan
Indicators:

MIME:
application/zip
File info:
Zip archive data, at least v2.0 to extract
MD5

ce9eb637a363bee64b40e855db7d4b54

SHA1

1512ff819033dabdcf576cc84b6cc74365f23ff9

SHA256

500aa7d4af5c2792d5c5b6ee4dba12b7fbacc48f8f6d19b8b725813f034cda34

SSDEEP

12288:8IylbUUsVKMnhdaRuWBkNDwWc3nLc0OtbAuKpUzDS8yklCy44sAe:VylbVTKXskyWcJ6bRKOfZ3lCg1e

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration
300 seconds
Additional time used
240 seconds
Fakenet option
off
Heavy Evaision option
off
MITM proxy
off
Route via Tor
off
Network geolocation
off
Privacy
Public submission
Autoconfirmation of UAC
on

Software preset

  • Internet Explorer 8.0.7601.17514
  • Adobe Acrobat Reader DC MUI (15.023.20070)
  • Adobe Flash Player 26 ActiveX (26.0.0.131)
  • Adobe Flash Player 26 NPAPI (26.0.0.131)
  • Adobe Flash Player 26 PPAPI (26.0.0.131)
  • Adobe Refresh Manager (1.8.0)
  • CCleaner (5.35)
  • FileZilla Client 3.36.0 (3.36.0)
  • Google Chrome (68.0.3440.106)
  • Google Update Helper (1.3.33.17)
  • Java 8 Update 92 (8.0.920.14)
  • Java Auto Updater (2.8.92.14)
  • Microsoft .NET Framework 4.6.1 (4.6.01055)
  • Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Professional 2010 (14.0.6029.1000)
  • Microsoft Office Proof (English) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (French) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
  • Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
  • Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Single Image 2010 (14.0.6029.1000)
  • Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
  • Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
  • Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
  • Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
  • Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
  • Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
  • Mozilla Firefox 61.0.2 (x86 en-US) (61.0.2)
  • Notepad++ (32-bit x86) (7.5.1)
  • Opera 12.15 (12.15.1748)
  • Skype version 8.29 (8.29)
  • VLC media player (2.2.6)
  • WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

  • Client LanguagePack Package
  • Client Refresh LanguagePack Package
  • CodecPack Basic Package
  • Foundation Package
  • IE Troubleshooters Package
  • InternetExplorer Optional Package
  • KB2534111
  • KB2999226
  • KB976902
  • LocalPack AU Package
  • LocalPack CA Package
  • LocalPack GB Package
  • LocalPack US Package
  • LocalPack ZA Package
  • ProfessionalEdition
  • UltimateEdition

Behavior activities

MALICIOUS SUSPICIOUS INFO
Writes file to Word startup folder
  • powershell.exe (PID: 3632)
Deletes shadow copies
  • powershell.exe (PID: 3632)
Dropped file may contain instructions of ransomware
  • powershell.exe (PID: 3632)
GandCrab keys found
  • powershell.exe (PID: 3632)
Renames files like Ransomware
  • powershell.exe (PID: 3632)
Connects to CnC server
  • powershell.exe (PID: 3632)
Actions looks like stealing of personal data
  • powershell.exe (PID: 3632)
Reads Internet Cache Settings
  • powershell.exe (PID: 3632)
Creates files like Ransomware instruction
  • powershell.exe (PID: 3632)
Reads the cookies of Mozilla Firefox
  • powershell.exe (PID: 3632)
Starts CMD.EXE for commands execution
  • powershell.exe (PID: 3632)
Creates files in the user directory
  • WScript.exe (PID: 3796)
  • powershell.exe (PID: 3632)
Executes PowerShell scripts
  • WScript.exe (PID: 3796)
Reads Microsoft Office registry keys
  • WINWORD.EXE (PID: 2676)
Creates files in the user directory
  • WINWORD.EXE (PID: 2676)
Dropped object may contain TOR URL's
  • powershell.exe (PID: 3632)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD
.zip
|   ZIP compressed archive (100%)
EXIF
ZIP
ZipRequiredVersion:
788
ZipBitFlag:
0x0001
ZipCompression:
Deflated
ZipModifyDate:
2018:12:03 03:14:14
ZipCRC:
0x649b9707
ZipCompressedSize:
447720
ZipUncompressedSize:
1856102
ZipFileName:
____________.js

Screenshots

Processes

Total processes
50
Monitored processes
10
Malicious processes
2
Suspicious processes
0

Behavior graph

+
start winrar.exe no specs wscript.exe no specs #GANDCRAB powershell.exe winword.exe no specs wscript.exe no specs wmic.exe no specs explorer.exe no specs cmd.exe no specs timeout.exe no specs notepad.exe no specs
Specs description
Program did not start
Integrity level elevation
Task сontains an error or was rebooted
Process has crashed
Task contains several apps running
Executable file was dropped
Debug information is available
Process was injected
Network attacks were detected
Application downloaded the executable file
Actions similar to stealing personal data
Behavior similar to exploiting the vulnerability
Inspected object has sucpicious PE structure
File is detected by antivirus software
CPU overrun
RAM overrun
Process starts the services
Process was added to the startup
Behavior similar to spam
Low-level access to the HDD
Probably Tor was used
System was rebooted
Connects to the network
Known threat

Process information

Click at the process to see the details.

PID
3460
CMD
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\____________.js.zip"
Path
C:\Program Files\WinRAR\WinRAR.exe
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Version:
Company
Alexander Roshal
Description
WinRAR archiver
Version
5.60.0
Modules
Image
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\shlwapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\uxtheme.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\riched20.dll
c:\program files\common files\microsoft shared\ink\tiptsf.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ehstorshell.dll
c:\windows\system32\cscui.dll
c:\windows\system32\cscdll.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\slc.dll
c:\windows\system32\imageres.dll
c:\windows\system32\mpr.dll
c:\windows\system32\drprov.dll
c:\windows\system32\winsta.dll
c:\windows\system32\ntlanman.dll
c:\windows\system32\davclnt.dll
c:\windows\system32\davhlpr.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\wpdshext.dll
c:\windows\system32\winmm.dll
c:\windows\system32\portabledeviceapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\audiodev.dll
c:\windows\system32\wmvcore.dll
c:\windows\system32\wmasf.dll
c:\windows\system32\ehstorapi.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\samcli.dll
c:\windows\system32\samlib.dll
c:\windows\system32\profapi.dll
c:\windows\system32\wshext.dll
c:\windows\system32\wscript.exe
c:\windows\system32\explorerframe.dll
c:\windows\system32\duser.dll
c:\windows\system32\dui70.dll

PID
3796
CMD
"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\____________.js"
Path
C:\Windows\System32\WScript.exe
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Microsoft ® Windows Based Script Host
Version
5.8.7600.16385
Modules
Image
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\version.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\sxs.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\jscript.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\msisip.dll
c:\windows\system32\wshext.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\scrobj.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\scrrun.dll
c:\windows\system32\wshom.ocx
c:\windows\system32\mpr.dll
c:\program files\common files\system\ado\msado15.dll
c:\windows\system32\msdart.dll
c:\windows\system32\mlang.dll
c:\windows\system32\propsys.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll

PID
3632
CMD
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "IEX (([System.IO.File]::ReadAllText('C:\Users\admin\AppData\Roaming\qaqjnce.log')).Replace('?',''));"
Path
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Indicators
Parent process
WScript.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows PowerShell
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\atl.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\shell32.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\linkinfo.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\slc.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\version.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorwks.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system\9e0a3b9b9f457233a335d7fba8f95419\system.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\4bdde288f147e3b3f2c090ecdf704e6d\microsoft.powershell.consolehost.ni.dll
c:\windows\assembly\gac_msil\system.management.automation\1.0.0.0__31bf3856ad364e35\system.management.automation.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.management.a#\a8e3a41ecbcc4bb1598ed5719f965110\system.management.automation.ni.dll
c:\windows\system32\psapi.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.core\fbc05b5b05dc6366b02b8e2f77d080f1\system.core.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\e112e4460a0c9122de8c382126da4a2f\microsoft.powershell.commands.diagnostics.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.configuratio#\f02737c83305687a68c088927a6c5a98\system.configuration.install.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.wsman.man#\f1865caa683ceb3d12b383a94a35da14\microsoft.wsman.management.ni.dll
c:\windows\assembly\gac_msil\microsoft.wsman.runtime\1.0.0.0__31bf3856ad364e35\microsoft.wsman.runtime.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.transactions\ad18f93fc713db2c4b29b25116c13bd8\system.transactions.ni.dll
c:\windows\assembly\gac_32\system.transactions\2.0.0.0__b77a5c561934e089\system.transactions.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\82d7758f278f47dc4191abab1cb11ce3\microsoft.powershell.commands.utility.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\583c7b9f52114c026088bdb9f19f64e8\microsoft.powershell.commands.management.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\6c5bef3ab74c06a641444eff648c0dde\microsoft.powershell.security.ni.dll
c:\windows\microsoft.net\framework\v2.0.50727\culture.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.xml\461d3b6b3f43e6fbe6c897d5936e17e4\system.xml.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\system.management.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.directoryser#\45ec12795950a7d54691591c615a9e3c\system.directoryservices.ni.dll
c:\windows\system32\shfolder.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.data\1e85062785e286cd9eae9c26d2c61f73\system.data.ni.dll
c:\windows\assembly\gac_32\system.data\2.0.0.0__b77a5c561934e089\system.data.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorjit.dll
c:\windows\system32\mpr.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\drprov.dll
c:\windows\system32\winsta.dll
c:\windows\system32\ntlanman.dll
c:\windows\system32\davclnt.dll
c:\windows\system32\davhlpr.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\iconcodecservice.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\oleacc.dll

PID
2676
CMD
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Desktop\dealdeep.rtf"
Path
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Microsoft Word
Version
14.0.6024.1000
Modules
Image
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\microsoft office\office14\wwlib.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\program files\microsoft office\office14\gfx.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msimg32.dll
c:\program files\microsoft office\office14\oart.dll
c:\program files\common files\microsoft shared\office14\mso.dll
c:\windows\system32\msi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\apphelp.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\program files\common files\microsoft shared\office14\cultures\office.odf
c:\program files\microsoft office\office14\1033\wwintl.dll
c:\program files\common files\microsoft shared\office14\1033\msointl.dll
c:\program files\common files\microsoft shared\office14\msores.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\dwmapi.dll
c:\program files\common files\microsoft shared\office14\msptls.dll
c:\windows\system32\uxtheme.dll
c:\program files\common files\microsoft shared\office14\riched20.dll
c:\windows\system32\mscoree.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\version.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorwks.dll
c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppc.dll
c:\windows\system32\winspool.drv
c:\windows\system32\shell32.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\msxml6.dll
c:\windows\system32\profapi.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\spool\drivers\w32x86\3\unidrvui.dll
c:\windows\system32\spool\drivers\w32x86\3\sendtoonenoteui.dll
c:\windows\system32\spool\drivers\w32x86\3\mxdwdrv.dll
c:\windows\system32\fontsub.dll
c:\windows\system32\prntvpt.dll
c:\program files\common files\microsoft shared\office14\usp10.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\linkinfo.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\slc.dll
c:\program files\microsoft office\office14\msproof7.dll
c:\program files\microsoft office\office14\proof\1033\msgr3en.dll
c:\program files\microsoft office\office14\gkword.dll
c:\windows\system32\oleacc.dll
c:\program files\common files\system\ado\msadox.dll
c:\windows\system32\netutils.dll

PID
3188
CMD
"C:\Windows\System32\WScript.exe" "C:\Users\admin\Desktop\____________.js"
Path
C:\Windows\System32\WScript.exe
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Microsoft ® Windows Based Script Host
Version
5.8.7600.16385
Modules
Image
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\version.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\sxs.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\jscript.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\msisip.dll
c:\windows\system32\wshext.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\scrobj.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\scrrun.dll
c:\windows\system32\wshom.ocx
c:\windows\system32\mpr.dll
c:\program files\common files\system\ado\msado15.dll
c:\windows\system32\msdart.dll
c:\windows\system32\mlang.dll

PID
2732
CMD
"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
Path
C:\Windows\system32\wbem\wmic.exe
Indicators
No indicators
Parent process
powershell.exe
User
admin
Integrity Level
MEDIUM
Exit code
2147749908
Version:
Company
Microsoft Corporation
Description
WMI Commandline Utility
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\wbem\wmic.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\secur32.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\wbem\wbemprox.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\msxml3.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\program files\common files\microsoft shared\office14\msoxmlmf.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\wbem\wbemsvc.dll
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\ntdsapi.dll
c:\windows\system32\wbem\wmiutils.dll

PID
3024
CMD
"C:\Windows\explorer.exe"
Path
C:\Windows\explorer.exe
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
Windows Explorer
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\explorerframe.dll
c:\windows\system32\duser.dll
c:\windows\system32\dui70.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\slc.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\propsys.dll
c:\windows\system32\cryptbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\actxprxy.dll

PID
3012
CMD
"C:\Windows\System32\cmd.exe" /c timeout -c 5 & del "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /f /q
Path
C:\Windows\System32\cmd.exe
Indicators
No indicators
Parent process
powershell.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\timeout.exe

PID
4036
CMD
timeout -c 5
Path
C:\Windows\system32\timeout.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
timeout - pauses command processing
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\timeout.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\version.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll

PID
2748
CMD
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Documents\YGLRN-DECRYPT.txt
Path
C:\Windows\system32\NOTEPAD.EXE
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Version:
Company
Microsoft Corporation
Description
Notepad
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\shlwapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\winspool.drv
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\version.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\uxtheme.dll

Registry activity

Total events
1577
Read events
1435
Write events
138
Delete events
4

Modification events

PID
Process
Operation
Key
Name
Value
3460
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
ShellExtBMP
3460
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
ShellExtIcon
3460
WinRAR.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
LanguageList
en-US
3460
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
0
C:\Users\admin\AppData\Local\Temp\____________.js.zip
3460
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
name
120
3460
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
size
80
3460
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
type
120
3460
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
mtime
100
3460
WinRAR.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
@C:\Windows\System32\wshext.dll,-4804
JScript Script File
3460
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
0
C:\Users\admin\Desktop
3460
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\Interface
ShowPassword
0
3796
WScript.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
3796
WScript.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
3632
powershell.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
LanguageList
en-US
3632
powershell.exe
write
HKEY_CURRENT_USER\Software\ex_data\data
ext
2E00790067006C0072006E000000
3632
powershell.exe
write
HKEY_CURRENT_USER\Software\keys_data\data
public
0602000000A40000525341310008000001000100DD7C8F9962AA6BA8D353A9531C73AB613C9E27F450A79D61BE7A88FE700D7BEB148F69F945DFBA83BD1344454F3B3BCCB6FD3938E68D262AE6CEF15B2D48E0E1923714A37394A75FEA10EECA7687A1AA53B7F3A4C06E5DF3E2628FE55403900C3C9B7411D79FB1610DB58BC99C1E389F2070270593D09EC3F6E1CB7D3FFF90E6A52B6376EDC4AC7B44FCF36DD1E5E2864F072465D741B8B00ADDB069E08FAFD96443AC57222BD2690B4660A8363ADA5F472579C309D6B62C475705F82BE96575EC66880F036D089209D7CCFCD2D723DE3C08C8AF19BF128035A7F92BA42FBCCB3F516EB4659565EB6138B7B2E4D4A1B621FF4C53C0F375275535B51E38074CC1
3632
powershell.exe
write
HKEY_CURRENT_USER\Software\keys_data\data
private
94040000F505859906F56F4A06DFD0BDB9A9759D5D26CE937FBDB4C1F6E0D672518F2CC22BCC82A96E295D1FE2AEEFBBDDFA6BA8F3CCB946087272255729460A582ED52FA318C562B6DC6F7413E17214B984519438F01D0AC75DD8910D7D55E5ED6FECC882C5E8AD772CB26390DEC503F914F09E4F74862833DE4F5C67A0D2A012899BF5839E0930DDD761DA551CEFC524DAADD124B4C395233355A76270FE818ADEF7171B24933A9B08FDE2F4A2A477AB648E1F80D3A6C7D65DCF5F19E70C247DAE7F0E7325825A435D49DCF2D20E263409E67BCA789CAF5BA928B4508326C12B52871DFCE335F91E700390F0736B13570E03CDEC38F2A23CDB2DD690A5BBFC15A32380DC8D8724890BDBFE80B300BC030BD88AC24AA82C28AA1C7000E186E73DDFEB8F1D5475A4497D5D2A0CE6ECD2EC2307251FA3AA4526BDD1D538930C24B2EBC73FB8A541B996656E25FAD9C5809F4AAD8AB770E2922586679F6E96DF60085C2D59C30A996676D239BE6BF39988C706FA71128328DCE89E4017420DC532729EBFDB0494ACBD5BABC3E1A8EF8DA14AA13ADCF318EF0F93B8783A730BE3B97BB44A413F42797CFD348D91A93316EB30F2FFC9B87EAB6B84AF27066CA34D308474704405757F816A8C1565D02B041CCF7D23F8BF6668CF6B7C2CDDAC3A91CED540B9C02A65235515665C1D0E281155C0194D90F42A96FA259AE400B609321895A91D0A7378FC2395568EDBFF71FAEBCBC003E204F4BA8DFDB4E74B7502646D62B617E5A35C5422E82869A7A31B3E955A9CC08A3E848043490B68458E9FDB6670F7B6775A658186EB5668E21DA6B2A46AAA266224B12A84D24DCB34D057BB79E7B79A85C5AC069C9965BD1850E296D3265BA33E3DC74B8F3198FF8B25B93664CFFD4C74452AE443969A35AE5D245AF5F915C8236C0681C3248E92EEA28E8623C5A69558C41D16E19DFB47C6AE9B53378B120FDD4BBCF7C20D976E0E86AE18171927A36921B4F7F7B392B2FEB024A85113A8E8DEEDE7F04D575EE0AF4AE63C8646B8B3163B86D1FD174A36750F23AA91EB9899C90FB7B06D49E6341E09468C0FA9EC092291EFBA4A47DDC96942CA8986CCA6D8B32F1D84F5501F8F9950A45D5A154676767D1AF2DC518CEA33EB179D79F48899F47CFE59006B183D7555DB7EB00D12A25BFE6D09D8D692B5C0B3E02C2AADAD3F2141B673F7A400806F01E89D5BB31B1EFCA0935006EA264F901A9225C3FE5D7E08314B91664853D8174BB9BCE471C4E1F79F65182919CD48963872679F110F7311506907E3DBBA05C3A4D1B0E503EC8CC98DE411AA403C92FFE3D470AF73149D03727CD4CEC5EB5F251AACF9067D4A51ECE790C3470EACF586834DADC5262E5D8F0BCA292BAF6E5994F558A8C1943182B6B41C72E9C23AA6A1C43966518F0705145C7E9271B42F1AA21C719C469E9E7307C4CC58320F90CD5EF9388E6B8B07676C706D4E9BB76D07F6A090F95C401094075E57A17A5E7BAF55588E6FEF312342AA23421658BD703545E30AFDCFFDC6B852F359705D2262D175E9AEBB6BDAA42AE8C72130D79BE24A5278642B9AD02ED047F694FD0A52CE37FEF56DDA235D58C901202C05B19446A6877DDC14FDEC1A068AF50CD751CC9BDB921BE68EE677541B969C549BF52C7D3611FFB293908F94A1D5DB14044DB40B3F31F7DB8093BBD015CEA79139243861A45FC64105A23F861259D0604E7AC32F85473DD8FB676BFFE29C5603B28195B7D9F384FAC2D1A520E5D5B48F6D4FFCCAAA3931993EF0852750E6A26282A7E1D2535DDB64633F9C7BD664FE55347172E1F75076EFEAA0F6C9CBA8B1528932D9CD08A3CB5DEA9E4EB9C3E574391BAC5E2D259773ADD6BB202FD5891DCC79DD00D8EB229A27BB6918A22CE047B258F27EE5063A8313CD549BD6D0EE7A04E1583ED8719D5F28E84908296451B56BC9766D76A5E9FF9BC6482F1225CDB4377FFD5DF086F84A0B9A9A989470753E90FA6EB540152B2B2704FF8DBC4AFEB3993F5A908289716C83459F0B7FE760D1D683363204D1562CA54EB8CCB1513610B17578FF83CE1CFC8E5A44C70AA84C277D7826A6183A820CA02A469D62FDA6C1A45F7536C4B2CAF7D79F1ECEA24726E850F9977FC0EA398DD565EC8824469130EBE885A59D28A21CE3AFE8A48D9E4538FACF6859CAA54EA6EC890F02184FA2D459755DDFB067F3739910C7C210DD08646EF3447E00000006993B9060808341308280FC41D0165CEFCBE59C5EE589942CC56326586BE1F1DE63C2A47F3277D7E29969E98562B7DCEA76FE2F5D14A7AE61D4012635C8966BD6C0A7A66DAFE39813EC8B057465EF0B7371B27F7F6072D6DC47A677B6A858D107698482C373F45C53FD3A80
3632
powershell.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
3632
powershell.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
3632
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableFileTracing
0
3632
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableConsoleTracing
0
3632
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileTracingMask
4294901760
3632
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
ConsoleTracingMask
4294901760
3632
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
MaxFileSize
1048576
3632
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileDirectory
%windir%\tracing
3632
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableFileTracing
0
3632
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableConsoleTracing
0
3632
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileTracingMask
4294901760
3632
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
ConsoleTracingMask
4294901760
3632
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
MaxFileSize
1048576
3632
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileDirectory
%windir%\tracing
3632
powershell.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0
3632
powershell.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
2676
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
v??
763F3F00740A0000010000000000000000000000
2676
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
Off
2676
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
On
2676
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
WORDFiles
1300627480
2676
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
ProductFiles
1300627600
2676
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
ProductFiles
1300627601
2676
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
MTTT
740A00007061EE7E0D8DD40100000000
2676
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
za?
7A613F00740A000004000000000000008C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
2676
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
2676
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
2676
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
db?
64623F00740A000006000000010000005800000002000000480000000400000063003A005C00750073006500720073005C00610064006D0069006E005C006400650073006B0074006F0070005C006400650061006C0064006500650070002E00720074006600000000000000
2676
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
ReviewToken
{48381696-4D46-4987-8807-7BE673717748}
2676
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Place MRU
Max Display
25
2676
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Place MRU
Item 1
[F00000000][T01D48D0D7FB69370][O00000000]*C:\Users\admin\Desktop\
2676
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\File MRU
Max Display
25
2676
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\File MRU
Item 1
[F00000000][T01D48D0D7FB69370][O00000000]*C:\Users\admin\Desktop\dealdeep.rtf
2676
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\14C35F
14C35F
04000000740A00002300000043003A005C00550073006500720073005C00610064006D0069006E005C004400650073006B0074006F0070005C006400650061006C0064006500650070002E007200740066000C0000006400650061006C0064006500650070002E0072007400660000000000010000000000000080F2F286EBA2D2015FC314005FC3140000000000DB040000000000000000000000000000000000000000000000000000FFFFFFFF0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000FFFFFFFF
2676
WINWORD.EXE
delete key
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems
2676
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00000000000F01FEC\Usage
SpellingAndGrammarFiles_3082
1300627497
2676
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00000000000F01FEC\Usage
SpellingAndGrammarFiles_3082
1300627498
2676
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400000000000F01FEC\Usage
SpellingAndGrammarFiles_1036
1300627497
2676
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400000000000F01FEC\Usage
SpellingAndGrammarFiles_1036
1300627498
2676
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
1300627514
2676
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
1300627515
2676
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00000000000F01FEC\Usage
SpellingAndGrammarFiles_3082
1300627499
2676
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100A0C00000000000F01FEC\Usage
SpellingAndGrammarFiles_3082
1300627500
2676
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400000000000F01FEC\Usage
SpellingAndGrammarFiles_1036
1300627499
2676
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F100C0400000000000F01FEC\Usage
SpellingAndGrammarFiles_1036
1300627500
2676
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Licensing
019C826E445A4649A5B00BF08FCC4EEE
01000000270000007B39303134303030302D303033442D303030302D303030302D3030303030303046463143457D005A0000004F00660066006900630065002000310034002C0020004F0066006600690063006500500072006F00660065007300730069006F006E0061006C002D00520065007400610069006C002000650064006900740069006F006E000000
2676
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
1300627516
2676
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
1300627517
2676
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
1300627518
2676
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
1300627519
2676
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
1300627520
2676
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109F10090400000000000F01FEC\Usage
SpellingAndGrammarFiles_1033
1300627521
2676
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Toolbars\Settings
Microsoft Word
0101000000000000000006000000
2676
WINWORD.EXE
delete key
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery\14C35F
2676
WINWORD.EXE
delete key
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\DocumentRecovery
2676
WINWORD.EXE
delete key
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency
2676
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Data
Settings
C00010033001000034010000040000001E0000001E0000001E0000001E0000001E0000001E000000220000001E0000001E0000001E000000060000000600000006000000060000000600000000000000060000000600000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000C00000002000000020000000200000002000000000000000000000000000000480000000600000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000DC000000E25024A1100A00633090060007000A002D001600000016000000C0030000F501000004060300000000000000000000000000040087010C000600C80009000180FFFF000006000000040000000C0100000502000000000000A004020000001200000000603090000064000000000000FF0000FF000000000000FF01000000010000005C08E0100000000000010000E40400001D000100000000000000020050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000D000000000000000000000000D4944600D49446010000002F91010000080A000600000003333296040000000A050C0C0302040600000300000101010606060000000000000000000000000000000000000063631900000001000000000000000000000000000000030000002000640000006363190000008C0A00000000E01000004B0000004B0000002000640000006363190000008C0A00000000E01000004B0000004B0000002100190000006363190000008C0A00000000E01000004B0000004B0000002000640000006363190000008C0A00000000E01000004B0000004B0000002000640000006301190000008C0A00000000E01000004B0000004B0000002000640000006301190000008C0A00000000B01300004B0000004B000000640000002000640000006363190000008C0A00000000E01000004B0000004B0000002000640000006363190000008C0A00000000E01000004B0000004B0000002000640000006363190000008C0A00000000E01000004B0000004B0000009002000002000001010101010101000101010101010001010100010001000101010101010101000100020003010301030103000301020003010301030103010000230101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010101020101010101010101010101010101010101010101010101010101010101010101010101010101010101010101010301010101010101010101010101FFFFCFFFFFFF00008602FFFF00008602FFFF00000C00FFFF00000100FFFF00000100FFFF0000010061000000610064006D0069006E000000000000000000000087FFFF0300003E00020200000600090034000000000090009000000000000F000000FFFFFF000000000000001400140000000000000002637800C80000000000140000000000900090008000FFFF00000800FFFF00000800FFFF0B00040001002000018014000B0043006F007500720069006500720020004E0065007700018014000B0043006F007500720069006500720020004E0065007700018014000B0043006F007500720069006500720020004E00650077000180140001002000018014000B0043006F007500720069006500720020004E00650077000180140009004D005300200047006F0074006800690063000180150007004D0069006E0067004C0069005500018018000600530069006D00530075006E0001801500050044006F00740075006D00018014000100200001801C0000000000
2676
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Options
BackgroundOpen
0
2676
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
ProductFiles
1300627602
2676
WINWORD.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
ProductFiles
1300627603
2676
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
MTTF
84
2676
WINWORD.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word
MTTA
84

Files activity

Executable files
0
Suspicious files
276
Text files
208
Unknown types
15

Dropped files

PID Process Filename Type
3632 powershell.exe C:\Users\admin\AppData\Local\Temp\pidor.bmp image
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata-v2 ––
3632 powershell.exe C:\Users\Public\Videos\Sample Videos\Wildlife.wmv ––
3632 powershell.exe C:\Users\Public\Videos\Sample Videos\Wildlife.wmv.yglrn ––
3632 powershell.exe C:\Users\Public\Videos\Sample Videos\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv.yglrn ––
3632 powershell.exe C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv ––
3632 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.yglrn binary
3632 powershell.exe C:\Users\Public\Recorded TV\Sample Media\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\Public\Recorded TV\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg ––
3632 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.yglrn binary
3632 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg ––
3632 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.yglrn binary
3632 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg ––
3632 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.yglrn binary
3632 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Koala.jpg ––
3632 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.yglrn binary
3632 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg ––
3632 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.yglrn binary
3632 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg ––
3632 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.yglrn binary
3632 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Desert.jpg ––
3632 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.yglrn binary
3632 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg ––
3632 powershell.exe C:\Users\Public\Pictures\Sample Pictures\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\Public\Music\Sample Music\Sleep Away.mp3.yglrn ––
3632 powershell.exe C:\Users\Public\Music\Sample Music\Sleep Away.mp3 ––
3632 powershell.exe C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.yglrn binary
3632 powershell.exe C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3 ––
3632 powershell.exe C:\Users\Public\Music\Sample Music\Kalimba.mp3.yglrn ––
3632 powershell.exe C:\Users\Public\Music\Sample Music\Kalimba.mp3 ––
3632 powershell.exe C:\Users\Public\Videos\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\Public\Downloads\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\Public\Music\Sample Music\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\Public\Libraries\RecordedTV.library-ms.yglrn fli
3632 powershell.exe C:\Users\Public\Favorites\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\Public\Libraries\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\Public\Libraries\RecordedTV.library-ms ––
3632 powershell.exe C:\Users\Public\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\Public\Pictures\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\Public\Documents\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\Public\Music\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\SendTo\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\Searches\Microsoft OneNote.searchconnector-ms.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\Searches\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\Searches\Microsoft Outlook.searchconnector-ms.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\Searches\Microsoft Outlook.searchconnector-ms ––
3632 powershell.exe C:\Users\admin\Searches\Microsoft OneNote.searchconnector-ms ––
3632 powershell.exe C:\Users\admin\Pictures\numbercareer.jpg.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\Pictures\leadingphotos.png.yglrn binary
3632 powershell.exe C:\Users\admin\Saved Games\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\Pictures\typesviews.png.yglrn binary
3632 powershell.exe C:\Users\admin\Pictures\allowsanything.jpg.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\Pictures\typesviews.png ––
3632 powershell.exe C:\Users\admin\Pictures\numbercareer.jpg ––
3632 powershell.exe C:\Users\admin\Pictures\leadingphotos.png ––
3632 powershell.exe C:\Users\admin\Pictures\allowsanything.jpg ––
3632 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Spaces.url.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\Links\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\ntuser.ini.yglrn binary
3632 powershell.exe C:\Users\admin\ntuser.ini ––
3632 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Spaces.url ––
3632 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Gallery.url.yglrn binary
3632 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Mail.url.yglrn binary
3632 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Mail.url ––
3632 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Gallery.url ––
3632 powershell.exe C:\Users\admin\Favorites\Windows Live\Get Windows Live.url.yglrn binary
3632 powershell.exe C:\Users\admin\Favorites\Windows Live\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSNBC News.url.yglrn binary
3632 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN.url.yglrn binary
3632 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Sports.url.yglrn binary
3632 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN.url ––
3632 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSNBC News.url ––
3632 powershell.exe C:\Users\admin\Favorites\Windows Live\Get Windows Live.url ––
3632 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Autos.url.yglrn binary
3632 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Entertainment.url.yglrn binary
3632 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Money.url.yglrn binary
3632 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Autos.url ––
3632 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Money.url ––
3632 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Entertainment.url ––
3632 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Sports.url ––
3632 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft Store.url.yglrn binary
3632 powershell.exe C:\Users\admin\Favorites\MSN Websites\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Home.url.yglrn binary
3632 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Work.url.yglrn binary
3632 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Work.url ––
3632 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft Store.url ––
3632 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Home.url ––
3632 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\Favorites\Links for United States\USA.gov.url.yglrn binary
3632 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\IE Add-on site.url.yglrn binary
3632 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\IE site on Microsoft.com.url.yglrn binary
3632 powershell.exe C:\Users\admin\Favorites\Links for United States\USA.gov.url ––
3632 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\IE site on Microsoft.com.url ––
3632 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\IE Add-on site.url ––
3632 powershell.exe C:\Users\admin\Favorites\Links for United States\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\Favorites\Links\Web Slice Gallery.url.yglrn binary
3632 powershell.exe C:\Users\admin\Favorites\Links\Suggested Sites.url.yglrn binary
3632 powershell.exe C:\Users\admin\Favorites\Links for United States\GobiernoUSA.gov.url.yglrn binary
3632 powershell.exe C:\Users\admin\Favorites\Links for United States\GobiernoUSA.gov.url ––
3632 powershell.exe C:\Users\admin\Favorites\Links\Suggested Sites.url ––
3632 powershell.exe C:\Users\admin\Favorites\Links\Web Slice Gallery.url ––
3632 powershell.exe C:\Users\admin\Downloads\peacelives.jpg.yglrn binary
3632 powershell.exe C:\Users\admin\Downloads\possiblehair.jpg.yglrn binary
3632 powershell.exe C:\Users\admin\Downloads\metaltown.jpg.yglrn binary
3632 powershell.exe C:\Users\admin\Downloads\protectionangeles.jpg.yglrn binary
3632 powershell.exe C:\Users\admin\Favorites\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\Favorites\Links\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\Downloads\protectionangeles.jpg ––
3632 powershell.exe C:\Users\admin\Downloads\possiblehair.jpg ––
3632 powershell.exe C:\Users\admin\Downloads\metaltown.jpg ––
3632 powershell.exe C:\Users\admin\Downloads\peacelives.jpg ––
3632 powershell.exe C:\Users\admin\Downloads\fargood.png.yglrn binary
3632 powershell.exe C:\Users\admin\Downloads\bornregion.png.yglrn binary
3632 powershell.exe C:\Users\admin\Documents\unlessaround.rtf.yglrn binary
3632 powershell.exe C:\Users\admin\Downloads\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\Downloads\fargood.png ––
3632 powershell.exe C:\Users\admin\Downloads\bornregion.png ––
3632 powershell.exe C:\Users\admin\Documents\unlessaround.rtf ––
3632 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook.pst.yglrn binary
3632 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook Data File - test.pst.yglrn binary
3632 powershell.exe C:\Users\admin\Documents\situationsilver.rtf.yglrn binary
3632 powershell.exe C:\Users\admin\Documents\Outlook Files\~Outlook.pst.tmp.yglrn binary
3632 powershell.exe C:\Users\admin\Documents\situationsilver.rtf ––
3632 powershell.exe C:\Users\admin\Documents\Outlook Files\~Outlook.pst.tmp ––
3632 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook.pst ––
3632 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook Data File - test.pst ––
3632 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst.yglrn binary
3632 powershell.exe C:\Users\admin\Documents\Outlook Files\honey@pot.com.pst.yglrn binary
3632 powershell.exe C:\Users\admin\Documents\Outlook Files\honey@pot.com.pst ––
3632 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst ––
3632 powershell.exe C:\Users\admin\Documents\Outlook Files\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\General.one.yglrn binary
3632 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\Open Notebook.onetoc2.yglrn binary
3632 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\Unfiled Notes.one.yglrn bs
3632 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\Unfiled Notes.one ––
3632 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\Open Notebook.onetoc2 ––
3632 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\General.one ––
3632 powershell.exe C:\Users\admin\Pictures\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\Documents\ohtests.rtf.yglrn fli
3632 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\Videos\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\Documents\ohtests.rtf ––
3632 powershell.exe C:\Users\admin\Documents\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\Documents\literaturesource.rtf.yglrn binary
3632 powershell.exe C:\Users\admin\Documents\carsbackground.rtf.yglrn binary
3632 powershell.exe C:\Users\admin\Desktop\____________.js.yglrn binary
3632 powershell.exe C:\Users\admin\Music\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\Documents\carsbackground.rtf ––
3632 powershell.exe C:\Users\admin\Documents\literaturesource.rtf ––
3632 powershell.exe C:\Users\admin\Desktop\____________.js ––
3632 powershell.exe C:\Users\admin\Desktop\whoselicense.jpg.yglrn binary
3632 powershell.exe C:\Users\admin\Desktop\stepused.rtf.yglrn binary
3632 powershell.exe C:\Users\admin\Desktop\whoselicense.jpg ––
3632 powershell.exe C:\Users\admin\Desktop\stepused.rtf ––
3632 powershell.exe C:\Users\admin\Desktop\roomfees.rtf.yglrn binary
3632 powershell.exe C:\Users\admin\Desktop\roomfees.rtf ––
3632 powershell.exe C:\Users\admin\Desktop\femalestudy.jpg.yglrn binary
3632 powershell.exe C:\Users\admin\Desktop\moviesled.jpg.yglrn binary
3632 powershell.exe C:\Users\admin\Desktop\moviesled.jpg ––
3632 powershell.exe C:\Users\admin\Desktop\dealdeep.rtf.yglrn binary
3632 powershell.exe C:\Users\admin\Desktop\dealdeep.rtf ––
3632 powershell.exe C:\Users\admin\Desktop\femalestudy.jpg ––
3632 powershell.exe C:\Users\admin\Desktop\blogsratings.png.yglrn binary
3632 powershell.exe C:\Users\admin\Desktop\boardcommercial.rtf.yglrn binary
3632 powershell.exe C:\Users\admin\Desktop\boardcommercial.rtf ––
3632 powershell.exe C:\Users\admin\Desktop\blogsratings.png ––
3632 powershell.exe C:\Users\admin\Contacts\admin.contact.yglrn binary
3632 powershell.exe C:\Users\admin\Desktop\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\WinRAR\version.dat.yglrn binary
3632 powershell.exe C:\Users\admin\Contacts\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\WinRAR\version.dat ––
3632 powershell.exe C:\Users\admin\Contacts\admin.contact ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\WinRAR\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Sun\Java\Deployment\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Sun\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\skypert.conf.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Sun\Java\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ul.conf.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\skypert.conf ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ul.conf ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ecs.conf.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_httpfe\queue.db.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_httpfe\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ecs.conf ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_httpfe\queue.db ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db-journal.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db-journal ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Skype\DataRv\offline-storage.data.yglrn gpg
3632 powershell.exe C:\Users\admin\AppData\Roaming\Skype\logs\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Skype\DataRv\offline-storage.data ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\qaqjnce.log.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Skype\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Skype\DataRv\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\qaqjnce.log ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\wand.dat.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\webserver\users.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\webserver\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\wand.dat ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\webserver\users.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\vlink4.dat.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\tips.ini.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\typed_history.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\typed_history.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\vlink4.dat ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\tips.ini ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structuretables.css.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureinline.css.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\tablelayout.css.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\toc.css.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\tablelayout.css ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureinline.css ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\toc.css ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structuretables.css ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\outline.css.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureblock.css.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablepositioning.css.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disabletables.css.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureblock.css ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disabletables.css ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\outline.css ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablepositioning.css ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablefloats.css.yglrn bs
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablebreaks.css.yglrn fli
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastwb.css.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disableforms.css.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastwb.css ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablebreaks.css ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablefloats.css ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disableforms.css ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\classid.css.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastbw.css.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\accessibility.css.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\altdebugger.css.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastbw.css ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\classid.css ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\altdebugger.css ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win.bak.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\speeddial.ini.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\accessibility.css ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\speeddial.ini ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\optrust.dat.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opuntrust.dat.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opuntrust.dat ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win.bak ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\optrust.dat ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opthumb.dat.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.dat.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\oprand.dat.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opthumb.dat ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.dat ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\oprand.dat ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opicacrt6.dat.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opcacrt6.dat.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.ini.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opcert6.dat.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opcert6.dat ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.ini ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opicacrt6.dat ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opcacrt6.dat ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\handlers.ini.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\global_history.dat.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\handlers.ini ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\cookies4.dat.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\download.dat.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\cookies4.dat ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\download.dat ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\global_history.dat ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Zenburn.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\bookmarks.adr.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Zenburn.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\bookmarks.adr ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Vibrant Ink.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\vim Dark Blue.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Vibrant Ink.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\vim Dark Blue.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Twilight.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Twilight.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Ruby Blue.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized-light.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Plastic Code Wrap.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Ruby Blue.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Plastic Code Wrap.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized-light.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Obsidian.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Navajo.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Obsidian.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\MossyLawn.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Navajo.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\MossyLawn.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Monokai.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Monokai.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Mono Industrial.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Mono Industrial.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\khaki.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\khaki.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\HotFudgeSundae.xml.yglrn ini
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Hello Kitty.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\HotFudgeSundae.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Deep Black.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Deep Black.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Hello Kitty.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Choco.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Choco.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Black board.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Black board.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Bespin.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Bespin.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\functionList.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\plugins\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\plugins\config\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\functionList.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\contextMenu.xml.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\profiles.ini.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\SystemExtensionsDev\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\contextMenu.xml ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\xulstore.json.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\webappsstore.sqlite.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\webappsstore.sqlite ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\xulstore.json ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\profiles.ini ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\toFetch\tabs.json.yglrn flc
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\toFetch\tabs.json ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\failed\tabs.json.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\toFetch\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\failed\tabs.json ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\times.json.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\failed\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\times.json ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage.sqlite.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage.sqlite ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\temporary\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\727688008bsleotcakcliifsittsr%.sqlite.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\727688008bsleotcakcliifsittsr%.sqlite ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\727688008bsleotcakcliifsittsr%.files\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3899588440psinninpiFn2g%.sqlite.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3899588440psinninpiFn2g%.sqlite ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3899588440psinninpiFn2g%.files\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3345959086bslnoocdkdlaiFs2t%s.sqlite.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.files\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3345959086bslnoocdkdlaiFs2t%s.sqlite ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3345959086bslnoocdkdlaiFs2t%s.files\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.files\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1725441852bxlfogcFk2l%isst.sqlite.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1725441852bxlfogcFk2l%isst.sqlite ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1725441852bxlfogcFk2l%isst.files\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1059394878bslnoicgkullipsFt2s%.sqlite.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1059394878bslnoicgkullipsFt2s%.sqlite ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1059394878bslnoicgkullipsFt2s%.files\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata-v2.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata-v2 ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.sqlite.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.sqlite ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\journals\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\1 ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\1.yglrn ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata-v2.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat dat
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.sqlite.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.sqlite ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\journals\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\1 ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\1.yglrn ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata-v2.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata-v2 ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\SiteSecurityServiceState.txt.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\SiteSecurityServiceState.txt ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore.jsonlz4.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore.jsonlz4 ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\previous.jsonlz4.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\previous.jsonlz4 ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4 ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\revocations.txt.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\revocations.txt ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pluginreg.dat.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pluginreg.dat ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\places.sqlite.yglrn ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\places.sqlite ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pkcs11.txt.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pkcs11.txt ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\permissions.sqlite.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\permissions.sqlite ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\minidumps\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\logins.json.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\logins.json ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\key4.db.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\key4.db ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\handlers.json.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\handlers.json ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\widevinecdm.dll.sig.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\widevinecdm.dll.sig ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\widevinecdm.dll.lib.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\widevinecdm.dll.lib ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\manifest.json.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\manifest.json ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\LICENSE.txt.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\LICENSE.txt ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-gmpopenh264\1.7.1\gmpopenh264.info.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-gmpopenh264\1.7.1\gmpopenh264.info ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-gmpopenh264\1.7.1\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-gmpopenh264\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp\WINNT_x86-msvc\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\formhistory.sqlite.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\formhistory.sqlite ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\favicons.sqlite.yglrn ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\favicons.sqlite ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\extensions.json.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\extensions.json ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\state.json.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\state.json ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\session-state.json.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\session-state.json ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536511076670.6fb1a61f-96c8-4004-a260-a8d32e45a07f.main.jsonlz4.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536511076670.6fb1a61f-96c8-4004-a260-a8d32e45a07f.main.jsonlz4 ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536510890757.0bd2c0b0-6051-4678-a27c-37f3c0a0c3bf.main.jsonlz4.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536510890757.0bd2c0b0-6051-4678-a27c-37f3c0a0c3bf.main.jsonlz4 ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536510464398.048632c6-c96b-486d-b119-7e1a7a9c9e9a.main.jsonlz4.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536510464398.048632c6-c96b-486d-b119-7e1a7a9c9e9a.main.jsonlz4 ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535455254239.6a6d1f6c-b378-42bd-83d4-6375a8d83c94.main.jsonlz4.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535455254239.6a6d1f6c-b378-42bd-83d4-6375a8d83c94.main.jsonlz4 ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589777.8901d324-d310-406e-8d96-2ba1529e4bea.first-shutdown.jsonlz4.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589777.8901d324-d310-406e-8d96-2ba1529e4bea.first-shutdown.jsonlz4 ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589776.07f73e80-2b12-40ae-97b0-fa87f3167670.main.jsonlz4.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589776.07f73e80-2b12-40ae-97b0-fa87f3167670.main.jsonlz4 ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589752.05c13197-8f39-40a1-b976-59f6f9c1cc5f.new-profile.jsonlz4.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589752.05c13197-8f39-40a1-b976-59f6f9c1cc5f.new-profile.jsonlz4 ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454581431.ff499cec-8d4b-47de-a059-a9aea3d69a66.main.jsonlz4.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454581431.ff499cec-8d4b-47de-a059-a9aea3d69a66.main.jsonlz4 ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\crashes\store.json.mozlz4.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\crashes\store.json.mozlz4 ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\crashes\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\crashes\events\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\content-prefs.sqlite.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\content-prefs.sqlite ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\containers.json.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\containers.json ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\compatibility.ini.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\compatibility.ini ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\bookmarkbackups\bookmarks-2018-08-28_14_uZyx1cMFmZ7ZpL4NneCk2A==.jsonlz4.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklists\plugins.json.yglrn binary
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\bookmarkbackups\YGLRN-DECRYPT.txt text
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\bookmarkbackups\bookmarks-2018-08-28_14_uZyx1cMFmZ7ZpL4NneCk2A==.jsonlz4 ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklists\plugins.json ––
3632 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklists\addons.json.yglrn binary