IOC Report
mal2

loading gif

Files

File Path
Type
Category
Malicious
mal2
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
initial sample
 malicious
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1000\desktop.ini.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1001\desktop.ini.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1002\desktop.ini.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\$Recycle.Bin\S-1-5-21-2246122658-3693405117-2476756634-1003\desktop.ini.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\.curlrc.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\.curlrc.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\_curlrc.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\Adobe Acrobat.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\Firefox.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\Google Chrome.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Music\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Videos\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\osver.txt.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\parse.dat.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\MF\Active.GRL.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\MF\Pending.GRL.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Access.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Excel.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Firefox.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\OneNote.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Outlook.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Word.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\Adobe Acrobat.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\Firefox.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\Google Chrome.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Music\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Pictures\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Videos\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft OneDrive\setup\refcount.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\AppV\Setup\OfficeIntegrator.ps1.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\DeploymentConfig.0.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\DeploymentConfig.1.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\DeploymentConfig.2.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\EventStore.db.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\osver.txt.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IdentityCRL\INT\wlidsvcconfig.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\edb.chk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\edb.log.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\edb00001.log.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\edbres00001.jrs.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\edbres00002.jrs.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\edbtmp.log.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\qmgr.db.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\qmgr.jfm.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Office\ClickToRunPackageLocker.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\guest.png.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\hardz.dat.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\jones.dat.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user.dat.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-192.png.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-32.png.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-40.png.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-48.png.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user.bmp.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user.png.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\MpDiag.bin.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\mpenginedb.db.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\AppxProvisioning.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\DeviceMetadataCache\dmrc.idx.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\OneSettings\CTAC.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\OneSettings\CortanaUWP.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\OneSettings\FeatureConfig.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\OneSettings\UsoSettings.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\OneSettings\config.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\wfp\wfpdiag.etl.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\7-Zip\7-Zip Help.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Access.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessibility\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Notepad.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Paint.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Quick Assist.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Snipping Tool.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Wordpad.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Adobe Acrobat.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Examples.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Excel.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Firefox Private Browsing.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Firefox.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Google Chrome.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\About Java.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\Check For Updates.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\Configure Java.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\Get Help.url.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\Visit Java.com.url.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Maintenance\Desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Microsoft Edge.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\OneNote.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Outlook.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\PowerPoint.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Publisher.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Skype for Business.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\StartUp\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\Task Manager.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Word.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Pictures\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft OneDrive\setup\refcount.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\AppV\Setup\OfficeIntegrator.ps1.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\DeploymentConfig.0.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\DeploymentConfig.1.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\DeploymentConfig.2.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedSettings\utc.allow.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.bk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedSettings\utc.privacy.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json.bk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\Diagtrack-Listener.etl.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\IdentityCRL\production\wlidsvcconfig.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Google.Protobuf.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,HtmlAgilityPack.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,MessagePack.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Newtonsoft.Json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Polly,7.2.4.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Polly.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,SQLitePCLRaw.core.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,SpanNetty.Buffers.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,SpanNetty.Codecs.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,SpanNetty.Common.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,SpanNetty.Transport.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Stateless,5.13.0.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Stateless.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,System.IO.Pipelines.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,System.Management.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.Auth.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Windows.edb.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Windows.jfm.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\edb.jcp.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\edb.jtx.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\edb00012.jtx.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\edb00013.jtx.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\edb00014.jtx.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\edbres00001.jrs.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\edbres00002.jrs.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\edbtmp.jtx.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\tmp.edb.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.jfm.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\DesktopSettings2013.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftNotepad.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win32.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win64.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin32.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win64.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win64.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin32.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin64.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win32.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win64.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin32.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\NetworkPrinters.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\ThemeSettings2013.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\VdiState.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-192.png.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-32.png.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-40.png.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\User Account Pictures\user-48.png.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\Policy.vpol.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpasdlta.lkg.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpasdlta.vdm.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpavdlta.lkg.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpavdlta.vdm.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.lkg.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpAsDesc.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpClient.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCommu.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpEvMsg.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpOAV.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpRtp.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpSvc.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpUpdate.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpLics.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpAsDesc.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpClient.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCommu.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDlp.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDlpCmd.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpEvMsg.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpRtp.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpSvc.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpUpdate.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\NisSrv.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mpextms.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Service\Detections.log.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Service\History.Log.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Service\Unknown.Log.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\MpDiag.bin.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Support\MPDetection-20231003-085557.log.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Support\MPLog-20231003-085557.log.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\Common Coverpages\en-GB\confident.cov.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\Common Coverpages\en-GB\fyi.cov.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\Common Coverpages\en-GB\generic.cov.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\Common Coverpages\en-GB\urgent.cov.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSFax\VirtualInbox\en-GB\WelcomeFax.tif.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\LfSvc\Geofence\GeofenceApplicationID.dat.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\OneSettings\ASAP_CloudPolicy.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\OneSettings\CortanaUWP.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\OneSettings\DirectXDbVersion.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\OneSettings\SCCInstallService.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\OneSettings\StorageGroveler.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\OneSettings\TroubleshootingSvc.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\OneSettings\UsoSettings.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip Help.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\Wordpad.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Examples.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Java\About Java.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Java\Configure Java.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Java\Get Help.url.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Java\Visit Java.com.url.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Publisher.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Skype for Business.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\state.rsm.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\AutoIt v3 Website.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\AutoItX\AutoItX Help File.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\Browse Extras.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Run Script (x64).lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Run Script (x86).lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\SciTE Script Editor.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Firefox Private Browsing.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\Check For Updates.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Microsoft Office Tools\Database Compare.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Microsoft Office Tools\Spreadsheet Compare.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\Task Manager.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Windows PowerShell\Windows PowerShell ISE.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Windows PowerShell\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\msoutilstat.etw.man.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.man.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\netfol.ico.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\pictures.ico.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ringtones.ico.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\settings.ico.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\sync.ico.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\wmp.ico.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_pref.ico.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_queue.ico.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_.ico.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedSettings\TELEMETRY.ASM-WINDOWSSQ.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json.bk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-Eco3PTelDefault.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json.bk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,ConcurrentDataStructures,0.2.0.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,ConcurrentDataStructures.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Google.Protobuf,3.23.4.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,HtmlAgilityPack,1.11.46.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,MessagePack,2.6.100-alpha.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,MessagePack.Annotations.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.AspNetCore.SignalR.Client.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.AspNetCore.SignalR.Common.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Data.Sqlite.Core,7.0.5.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Data.Sqlite.Core.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Caching.Memory.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Features,7.0.9.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Features.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Http,7.0.0.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Http.Polly.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Http.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Logging,7.0.0.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Logging.Debug.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Logging.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Options,7.0.1.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Options.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Primitives.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Graphics.Win2D,1.0.5.1.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Graphics.Win2D.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.IdentityModel.Abstractions.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.IdentityModel.Logging.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.IdentityModel.Tokens.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Bluetooth.Map.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Bluetooth.Pal.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Bluetooth.Pbap.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Diagnostics.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Obex,0.23051.1.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Obex.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.YourPhone.Vcard.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.NET.StringTools,17.4.0.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.NET.StringTools.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Rest.ClientRuntime,2.3.24.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Rest.ClientRuntime.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Toolkit.Uwp.Notifications.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Windows.Apps.TraceLogging.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Windows.AugLoop.Core.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.WindowsAppSDK.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Xaml.Behaviors.Wpf,1.1.39.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Xaml.Behaviors.Wpf.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Newtonsoft.Json,10.0.3.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Polly.Extensions.Http,3.0.0.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Polly.Extensions.Http.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,SQLitePCLRaw.bundle_e_sqlite3,2.1.4.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,SQLitePCLRaw.bundle_e_sqlite3.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,SQLitePCLRaw.core,2.1.4.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,SQLitePCLRaw.lib.e_sqlite3,2.1.4.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,SQLitePCLRaw.lib.e_sqlite3.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,SQLitePCLRaw.provider.e_sqlite3.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,SpanNetty.Buffers,0.7.2012.2221.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,SpanNetty.Codecs,0.7.2012.2221.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,SpanNetty.Codecs.Protobuf.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,SpanNetty.Common,0.7.2012.2221.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,SpanNetty.Transport,0.7.2012.2221.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,System.IO.Abstractions,19.2.51.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,System.IO.Abstractions.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,System.IO.Pipelines,7.0.0.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,System.IdentityModel.Tokens.Jwt.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,System.Management,7.0.1.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,TestableIO.System.IO.Abstractions.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP,0.23082.41.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.Auth,0.23082.41.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.Common,0.23082.41.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.Common.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.Onboarding,0.23082.41.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.Onboarding.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.PhoneLink,0.23082.41.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.PhoneLink.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.PlatformSdk,0.23082.41.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.PlatformSdk.Protocol.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.PlatformSdk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.ServicesClient.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.SideChannel,0.23082.41.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.SideChannel.Protocol.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.SideChannel.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\edb.chk_.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\edbres00001.jrs_.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Network\Downloader\edbres00002.jrs_.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin32.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\ThemeSettings2013.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\Policy.vpol.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\Policy.vpol_.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Catalogs\IGD.CAT.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\DefenderCSP.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Drivers\WdBoot.sys.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Drivers\WdDevFlt.sys.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Drivers\WdFilter.sys.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Drivers\WdNisDrv.sys.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Microsoft-Antimalware-NIS.man.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Microsoft-Antimalware-RTP.man.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpAzSubmit.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDetours.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDetoursCopyAccelerator.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpSenseComm.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpUxAgent.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Powershell\Defender.psd1.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Powershell\MSFT_MpScan.cdxml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ThirdPartyNotices.txt.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpAsDesc.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpClient.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetours.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpOAV.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MsMpLics.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\en-GB\mpasdesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\en-US\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\endpointdlp.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\af-ZA\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\am-ET\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ar-SA\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ar-SA\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\as-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\az-Latn-AZ\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\bg-BG\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\bg-BG\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\bn-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\bs-Latn-BA\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ca-ES\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ca-ES\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\cs-CZ\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\cs-CZ\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\cs-CZ\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\cy-GB\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\da-DK\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\da-DK\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\da-DK\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\de-DE\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\de-DE\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\de-DE\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\el-GR\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\el-GR\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\el-GR\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\en-GB\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\en-GB\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\en-US\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\en-US\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\en-US\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\endpointdlp.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\es-ES\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\es-ES\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\es-ES\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\es-MX\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\es-MX\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\et-EE\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\et-EE\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\eu-ES\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fa-IR\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fi-FI\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fi-FI\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fi-FI\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fil-PH\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fr-CA\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fr-CA\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fr-FR\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fr-FR\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fr-FR\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ga-IE\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\gd-GB\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\gl-ES\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\gu-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\he-IL\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\he-IL\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hi-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hr-HR\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hr-HR\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hu-HU\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hu-HU\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hu-HU\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\id-ID\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\id-ID\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\is-IS\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\it-IT\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\it-IT\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\it-IT\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ja-JP\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ja-JP\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ja-JP\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ka-GE\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\kk-KZ\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\km-KH\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\kn-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ko-KR\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ko-KR\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ko-KR\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\kok-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\lb-LU\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\lo-LA\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\lt-LT\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\lt-LT\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\lv-LV\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\lv-LV\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mi-NZ\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mk-MK\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ml-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mr-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ms-MY\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mt-MT\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\nb-NO\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\nb-NO\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\nb-NO\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ne-NP\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\nl-NL\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\nl-NL\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\nl-NL\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\nn-NO\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\or-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\pa-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\pl-PL\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\pl-PL\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\pl-PL\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ru-RU\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sk-SK\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sk-SK\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sl-SI\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sl-SI\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sq-AL\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sr-Cyrl-BA\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sr-Cyrl-RS\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sr-Latn-RS\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sr-Latn-RS\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sv-SE\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sv-SE\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sv-SE\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ta-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\te-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\th-TH\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\th-TH\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\tr-TR\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\tr-TR\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\tr-TR\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\tt-RU\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ug-CN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\uk-UA\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\uk-UA\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ur-PK\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\vi-VN\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\vi-VN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-CN\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-CN\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-CN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-TW\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-TW\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-TW\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Catalogs\IGD.CAT.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ConfigSecurityPolicy.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\DefenderCSP.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Drivers\WdBoot.sys.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Drivers\WdDevFlt.sys.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Drivers\WdFilter.sys.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Drivers\WdNisDrv.sys.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Microsoft-Antimalware-NIS.man.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Microsoft-Antimalware-RTP.man.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpAzSubmit.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCopyAccelerator.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDefenderCoreService.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDetours.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDetoursCopyAccelerator.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpSenseComm.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpUxAgent.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Powershell\Defender.psd1.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Powershell\MSFT_MpScan.cdxml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ProtectionManagement.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ProtectionManagement.mof.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ThirdPartyNotices.txt.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpAsDesc.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpCmdRun.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetours.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MsMpLics.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\en-GB\mpasdesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\en-US\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\endpointdlp.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\af-ZA\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\am-ET\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ar-SA\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ar-SA\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\as-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\az-Latn-AZ\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\bg-BG\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\bg-BG\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\bn-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\bs-Latn-BA\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ca-ES\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ca-ES\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\cs-CZ\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\cs-CZ\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\cs-CZ\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\cy-GB\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\da-DK\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\da-DK\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\da-DK\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\de-DE\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\de-DE\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\de-DE\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\el-GR\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\el-GR\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\el-GR\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\en-GB\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\en-GB\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\en-US\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\en-US\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\en-US\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\endpointdlp.dll.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\es-ES\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\es-ES\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\es-ES\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\es-MX\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\es-MX\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\et-EE\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\et-EE\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\eu-ES\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fa-IR\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fi-FI\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fi-FI\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fi-FI\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fil-PH\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fr-CA\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fr-CA\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fr-FR\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fr-FR\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fr-FR\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ga-IE\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\gd-GB\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\gl-ES\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\gu-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\he-IL\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\he-IL\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hi-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hr-HR\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hr-HR\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hu-HU\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hu-HU\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hu-HU\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\id-ID\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\id-ID\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\is-IS\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\it-IT\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\it-IT\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\it-IT\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ja-JP\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ja-JP\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ja-JP\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ka-GE\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\kk-KZ\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\km-KH\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\kn-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ko-KR\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ko-KR\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ko-KR\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\kok-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\lb-LU\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\lo-LA\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\lt-LT\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\lt-LT\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\lv-LV\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\lv-LV\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mi-NZ\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mk-MK\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ml-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mr-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ms-MY\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mt-MT\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\nb-NO\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\nb-NO\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\nb-NO\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ne-NP\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\nl-NL\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\nl-NL\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\nl-NL\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\nn-NO\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\or-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pa-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pl-PL\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pl-PL\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pl-PL\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pt-BR\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pt-BR\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pt-BR\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pt-PT\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pt-PT\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pt-PT\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\quz-PE\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ro-RO\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ro-RO\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ru-RU\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ru-RU\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ru-RU\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sk-SK\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sk-SK\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sl-SI\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sl-SI\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sq-AL\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sr-Cyrl-BA\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sr-Cyrl-RS\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sr-Latn-RS\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sr-Latn-RS\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sv-SE\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sv-SE\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sv-SE\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ta-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\te-IN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\th-TH\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\th-TH\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\tr-TR\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\tr-TR\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\tr-TR\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\tt-RU\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ug-CN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\uk-UA\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\uk-UA\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ur-PK\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\vi-VN\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\vi-VN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\zh-CN\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\zh-CN\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\zh-CN\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\zh-TW\MpAsDesc.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\zh-TW\MpEvMsg.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\zh-TW\mpuxagent.dll.mui.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\ReportLatency\Latency\01\2.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\ReportLatency\Latency\19\0.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\ReportLatency\Latency\19\1.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Service\Detections.log.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Service\History.Log.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Service\Unknown.Log.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Store\3846C1B485BFA46E3AB54DFBE9D1DE49.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Store\56598B41F139620898884E49C611C148.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Store\81FE2459AB45799D6C1FB53DEEE30AF6.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Store\93BCA88018E5993458BC6BBE55D33E61.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Store\9BBF8E3725F51A366740AC59C8CBB345.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Store\A0137882FC829131E8629036339BD1FB.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Scans\History\Store\C73297F3A28B41D0B045DECE1D0D81EF.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Support\MPDetection-20231003-085557.log.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Support\MPDeviceControl-20231003-122002.log.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\02305155-8ac1-1189-ff55-b7119a53887c.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\0890ad2f-b74f-c384-f684-9c33f8f67924.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\0a8c1492-65ca-6a01-de25-0e183559d10d.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\13edb933-4688-0f79-3d0a-499edf952ba0.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\18549a9c-bedc-b855-f0e6-0787d8b3300d.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\1e77870d-1a93-60e5-ffda-9653c7cad20a.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\1f7b7aa2-506a-03cd-6648-5b78ac12040f.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\1faf63f7-f387-4522-1175-68c9652d968a.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\215f9712-9fca-a3f8-5b11-660eefc73b96.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\28502d06-9d29-8514-1e5d-64447116d798.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\28748306-9f02-a5d7-6ded-4459fddadc31.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\292d761b-1fa7-9c70-1afd-c2e4040b6577.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\2b5d0f60-d93b-1629-f3e5-4167231c7ee6.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\2ff6ba33-4212-e6d3-dcc2-11aadb3d61ef.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\306e67c8-9a1d-38de-8654-054bd8a6e6d6.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\3f446420-d8ef-3b9c-d5b4-ba09c43121b4.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\42180d93-7e2c-7efa-09ed-dfdffa034b8e.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\436e78a7-dabb-5a30-f98d-963a03bf8af1.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\517cfcaf-138b-1796-2cea-62892204250a.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\52a7e8cc-4b89-0eb8-5b4c-0f924bfc3949.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\5c834b0b-64f8-6383-854a-915ac7ddab77.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\67447b0c-05cf-6740-5f7b-391ab440c42d.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\6ab96728-2783-240f-370f-afa9d4e52fdd.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\6e90ed81-9187-fa62-ce90-f18d7bed6b12.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\6ffa25dc-c89d-3de9-3601-df09bae65a75.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\832f9d1e-5f47-dfb1-157b-5239adf4c1db.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\8cfc804a-d777-2361-1670-4569e516397e.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\8d56e57b-8663-136d-ff69-a004e217825a.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\91a5b4c7-29a8-ec80-4321-fbecea906705.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\9a9f1e94-851b-c6b4-27c0-55a242e0d96d.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\a92561ce-87c0-7d40-42ea-c87d237c0db0.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\abbb44f6-ae33-2e7c-ac40-4d8ac17bf46b.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\ac116a72-b6b1-d558-23f6-10796e634d41.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\b59f5123-f94a-28bc-cf2d-1f77c3cd60ad.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\b6126597-8ecb-81b4-8b3a-1430dc2988c1.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\bb26a0e5-d235-0ee6-0c36-6d5e185fa5b1.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\ca947da2-7e9a-7249-8095-bceb379c6f74.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\d834be1c-66d4-85d2-5bfc-720e73e8e544.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\e64ffef1-e246-b632-595b-56076a3fa776.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\e78cdb72-8076-1aa5-5df6-048300a0f594.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\e8fff2df-6041-8f21-3df7-db31661aa09b.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\e9bff135-4a26-0e2f-d743-30d9666eed8e.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\ea39969e-9808-10a2-23ff-be783a132fea.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\eee47229-947d-2ac7-e8a3-49bafee251d1.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\f1d940d0-b5b2-0083-8403-807a8db430d5.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\f5fc8c03-78f6-342c-372b-15d02609bd3c.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\LfSvc\Geofence\GeofenceApplicationID.dat.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\OneSettings\ASAP_CloudPolicy.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\OneSettings\DirectXDbVersion.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\OneSettings\SCCInstallService.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\OneSettings\StorageGroveler.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\OneSettings\TroubleshootingSvc.json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessibility\Speech Recognition.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\Math Input Panel.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\Steps Recorder.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Fax and Scan.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Media Player.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Disk Cleanup.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Event Viewer.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Print Management.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Administrative Tools\RecoveryDrive.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Registry Editor.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Resource Monitor.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Task Scheduler.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Administrative Tools\dfrgui.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Administrative Tools\iSCSI Initiator.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\AutoIt Help File.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\AutoIt Window Info (x64).lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\AutoIt Window Info (x86).lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Check For SQLite Updates.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Check For Updates.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoIt v3 Website.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\Browse Extras.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Run Script (x64).lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Run Script (x86).lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\SciTE Script Editor.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\UpdateLock-308046B0AF4A39CB.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\state.rsm.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\System Tools\Character Map.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\Component Services.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\Computer Management.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\Memory Diagnostics Tool.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\ODBC Data Sources (32-bit).lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\ODBC Data Sources (64-bit).lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\Performance Monitor.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\Security Configuration Management.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\System Configuration.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\System Information.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Compile Script to .exe (x64).lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Compile Script to .exe (x86).lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\AutoItX\AutoItX Help File.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Microsoft Office Tools\Database Compare.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Microsoft Office Tools\Office Language Preferences.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Microsoft Office Tools\Skype for Business Recording Manager.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Microsoft Office Tools\Spreadsheet Compare.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Microsoft Office Tools\Telemetry Log for Office.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Windows PowerShell\Windows PowerShell ISE (x86).lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Windows PowerShell\Windows PowerShell ISE.lnk.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\User\NotifyIcon.0884f9b2-b6ec-4b87-899f-510361add0dc.1.etl.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\User\NotifyIcon.1d47542d-bdee-4dc6-94ed-be9cdb6f14e1.1.etl.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\User\NotifyIcon.21a55447-0332-4ea2-8e22-8ddd09981184.1.etl.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\User\NotifyIcon.38fad0bf-4730-4bc4-be22-5277e88811cd.1.etl.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\User\NotifyIcon.480bc3f4-4991-4ffc-b70d-c15db82e9d6a.1.etl.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\User\NotifyIcon.a686e598-6877-4264-9711-989651a302f7.1.etl.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\User\NotifyIcon.a821f645-76e8-4ba9-965c-60ad931c30ce.1.etl.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\User\NotifyIcon.c6e0f9e8-f670-49c4-974e-9d40568a1011.1.etl.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\User\NotifyIcon.d9261b8a-d5e2-42ed-ab32-cd2fab1962fc.1.etl.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\User\NotifyIcon.e99a38d9-255f-44d4-9ce1-275e8cf23855.1.etl.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\User\NotifyIcon.f3f7cc8e-795b-4925-9b8c-26e2ea300f41.1.etl.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\User\NotifyIcon.f4d4c9b8-57b5-43ca-ab7a-5d857e7666b9.1.etl.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\User\NotifyIcon.fbe50464-f61d-4a15-a5b7-ed239a079807.1.etl.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\USOShared\Logs\User\UpdateUx.475a5b13-420d-4358-9fdb-c77913ec90af.1.etl.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\ProductReleases\C773B593-9C79-47E6-BF01-073C12072B16\VirtualRegistry.dat.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\ProductReleases\C773B593-9C79-47E6-BF01-073C12072B16\en-us.16\s321033.hash.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\ProductReleases\C773B593-9C79-47E6-BF01-073C12072B16\operations.db.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\ProductReleases\C773B593-9C79-47E6-BF01-073C12072B16\x-none.16\i320.c2rx.hash.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\ProductReleases\C773B593-9C79-47E6-BF01-073C12072B16\x-none.16\s320.hash.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.accessmui.msi.16.en-us.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.dcfmui.msi.16.en-us.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.excelmui.msi.16.en-us.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.lyncmui.msi.16.en-us.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64mui.msi.16.en-us.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64ww.msi.16.x-none.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemui.msi.16.en-us.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.onenotemui.msi.16.en-us.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmmui.msi.16.en-us.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmuxmui.msi.16.en-us.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-GB\resource.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,MessagePack.Annotations,2.6.100-alpha.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.AspNetCore.Connections.Abstractions.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.AspNetCore.Http.Connections.Client.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.AspNetCore.Http.Connections.Common.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.AspNetCore.SignalR.Client,7.0.9.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.AspNetCore.SignalR.Client.Core,7.0.9.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.AspNetCore.SignalR.Client.Core.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.AspNetCore.SignalR.Common,7.0.9.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.AspNetCore.SignalR.Protocols.Json.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Caching.Abstractions,7.0.0.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Caching.Abstractions.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Caching.Memory,7.0.0.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.DependencyInjection,7.0.0.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.DependencyInjection.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Http.Polly,7.0.0.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Logging.Abstractions,7.0.1.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Logging.Abstractions.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Logging.Debug,7.0.0.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Primitives,7.0.0.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.IdentityModel.Abstractions,6.32.0.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.IdentityModel.JsonWebTokens,6.32.0.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.IdentityModel.JsonWebTokens.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.IdentityModel.Logging,6.32.0.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.IdentityModel.Tokens,6.32.0.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Bluetooth.Map,0.23051.1.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Bluetooth.Map.BMessage.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Bluetooth.Pal,0.23051.1.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Bluetooth.Pbap,0.23051.1.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Bluetooth.Profiles,0.23051.1.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Bluetooth.Profiles.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Diagnostics,0.23051.1.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.YourPhone.LibNanoApi.Managed.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.YourPhone.Vcard,0.22092.18.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Toolkit.Uwp.Notifications,7.1.2.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Windows.Apps.TraceLogging,1.0.8.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Windows.AugLoop.Core,0.0.230717008.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.WindowsAppSDK,1.3.230724000.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,SQLitePCLRaw.provider.e_sqlite3,2.1.4.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,SpanNetty.Codecs.Protobuf,0.7.2012.2221.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,System.IdentityModel.Tokens.Jwt,6.32.0.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,TestableIO.System.IO.Abstractions,19.2.51.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,TestableIO.System.IO.Abstractions.Wrappers.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.PlatformSdk.Protocol,0.23082.41.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.ServicesClient,0.23082.41.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.SideChannel.Protocol,0.23082.41.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.1.Crwl.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.1.gthr.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.2.Crwl.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.2.gthr.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.3.Crwl.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.3.gthr.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.000.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.001.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.002.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.000.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.001.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.002.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\Policy.vpol_.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\02305155-8ac1-1189-ff55-b7119a53887c.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\0890ad2f-b74f-c384-f684-9c33f8f67924.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\0a8c1492-65ca-6a01-de25-0e183559d10d.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\13edb933-4688-0f79-3d0a-499edf952ba0.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\18549a9c-bedc-b855-f0e6-0787d8b3300d.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\ClipSVC\Archive\Apps\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\.curlrc.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\.curlrc.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft OneDrive\setup\refcount.ini.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft OneDrive\setup\refcount.ini.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.0.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.0.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.1.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.1.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.2.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\DeploymentConfig.2.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\C773B593-9C79-47E6-BF01-073C12072B16\VirtualRegistry.dat.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\C773B593-9C79-47E6-BF01-073C12072B16\en-us.16\s321033.hash.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\C773B593-9C79-47E6-BF01-073C12072B16\operations.db.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\C773B593-9C79-47E6-BF01-073C12072B16\x-none.16\i320.c2rx.hash.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\ProductReleases\C773B593-9C79-47E6-BF01-073C12072B16\x-none.16\s320.hash.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\AirSpace.Etw.man.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.accessmui.msi.16.en-us.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.dcfmui.msi.16.en-us.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.excelmui.msi.16.en-us.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.lyncmui.msi.16.en-us.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64mui.msi.16.en-us.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.office64ww.msi.16.x-none.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.officemui.msi.16.en-us.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.onenotemui.msi.16.en-us.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmmui.msi.16.en-us.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.osmuxmui.msi.16.en-us.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.outlookmui.msi.16.en-us.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\C2RManifest.wordmui.msi.16.en-us.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\msoutilstat.etw.man.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\wordEtw.man.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\behavior.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\behavior.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-GB\resource.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
modified
 malicious
C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\folder.ico.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\netfol.ico.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\pictures.ico.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\ringtones.ico.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\settings.ico.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\sync.ico.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\tasks.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\wmp.ico.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\folder.ico.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_pref.ico.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\print_queue.ico.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\scan_.ico.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\tasks.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\TELEMETRY.ASM-WINDOWSSQ.json.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json.bk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.ASM-WindowsDefault.json.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\telemetry.P-Eco3PTelDefault.json.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.allow.json.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.bk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.app.json.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.cert.json.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.privacy.json.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json.bk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json.bk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Diagnosis\DownloadedSettings\utc.tracing.json.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Diagnosis\ETLLogs\ShutdownLogger\Diagtrack-Listener.etl.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Diagnosis\EventStore.db.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Diagnosis\osver.txt.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Diagnosis\osver.txt.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Diagnosis\parse.dat.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\IdentityCRL\INT\wlidsvcconfig.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\IdentityCRL\production\wlidsvcconfig.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\MF\Active.GRL.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\MF\Pending.GRL.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,ConcurrentDataStructures,0.2.0.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,ConcurrentDataStructures.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Google.Protobuf,3.23.4.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Google.Protobuf.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,HtmlAgilityPack,1.11.46.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,HtmlAgilityPack.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,MessagePack,2.6.100-alpha.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,MessagePack.Annotations,2.6.100-alpha.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,MessagePack.Annotations.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,MessagePack.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.AspNetCore.Connections.Abstractions.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.AspNetCore.Http.Connections.Client.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.AspNetCore.Http.Connections.Common.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.AspNetCore.SignalR.Client,7.0.9.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.AspNetCore.SignalR.Client.Core,7.0.9.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.AspNetCore.SignalR.Client.Core.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.AspNetCore.SignalR.Client.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.AspNetCore.SignalR.Common,7.0.9.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.AspNetCore.SignalR.Common.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.AspNetCore.SignalR.Protocols.Json.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Data.Sqlite.Core,7.0.5.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Data.Sqlite.Core.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Caching.Abstractions,7.0.0.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Caching.Abstractions.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Caching.Memory,7.0.0.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Caching.Memory.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.DependencyInjection,7.0.0.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.DependencyInjection.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Features,7.0.9.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Features.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Http,7.0.0.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Http.Polly,7.0.0.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Http.Polly.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Http.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Logging,7.0.0.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Logging.Abstractions,7.0.1.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Logging.Abstractions.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Logging.Debug,7.0.0.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Logging.Debug.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Logging.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Options,7.0.1.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Options.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Primitives,7.0.0.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Extensions.Primitives.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Graphics.Win2D,1.0.5.1.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Graphics.Win2D.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.IdentityModel.Abstractions,6.32.0.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.IdentityModel.Abstractions.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.IdentityModel.JsonWebTokens,6.32.0.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.IdentityModel.JsonWebTokens.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.IdentityModel.Logging,6.32.0.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.IdentityModel.Logging.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.IdentityModel.Tokens,6.32.0.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.IdentityModel.Tokens.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Bluetooth.Map,0.23051.1.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Bluetooth.Map.BMessage.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Bluetooth.Map.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Bluetooth.Pal,0.23051.1.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Bluetooth.Pal.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Bluetooth.Pbap,0.23051.1.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Bluetooth.Pbap.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Bluetooth.Profiles,0.23051.1.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Bluetooth.Profiles.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Diagnostics,0.23051.1.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Diagnostics.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Obex,0.23051.1.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.Obex.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.YourPhone.LibNanoApi.Managed.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.YourPhone.Vcard,0.22092.18.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Internal.YourPhone.Vcard.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.NET.StringTools,17.4.0.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.NET.StringTools.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Rest.ClientRuntime,2.3.24.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Rest.ClientRuntime.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Toolkit.Uwp.Notifications,7.1.2.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Toolkit.Uwp.Notifications.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Windows.Apps.TraceLogging,1.0.8.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Windows.Apps.TraceLogging.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Windows.AugLoop.Core,0.0.230717008.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Windows.AugLoop.Core.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.WindowsAppSDK,1.3.230724000.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.WindowsAppSDK.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Xaml.Behaviors.Wpf,1.1.39.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Microsoft.Xaml.Behaviors.Wpf.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Newtonsoft.Json,10.0.3.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Newtonsoft.Json.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Polly,7.2.4.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Polly.Extensions.Http,3.0.0.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Polly.Extensions.Http.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Polly.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,SQLitePCLRaw.bundle_e_sqlite3,2.1.4.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,SQLitePCLRaw.bundle_e_sqlite3.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,SQLitePCLRaw.core,2.1.4.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,SQLitePCLRaw.core.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,SQLitePCLRaw.lib.e_sqlite3,2.1.4.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,SQLitePCLRaw.lib.e_sqlite3.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,SQLitePCLRaw.provider.e_sqlite3,2.1.4.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,SQLitePCLRaw.provider.e_sqlite3.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,SpanNetty.Buffers,0.7.2012.2221.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,SpanNetty.Buffers.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,SpanNetty.Codecs,0.7.2012.2221.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,SpanNetty.Codecs.Protobuf,0.7.2012.2221.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,SpanNetty.Codecs.Protobuf.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,SpanNetty.Codecs.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,SpanNetty.Common,0.7.2012.2221.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,SpanNetty.Common.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,SpanNetty.Transport,0.7.2012.2221.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,SpanNetty.Transport.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Stateless,5.13.0.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,Stateless.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,System.IO.Abstractions,19.2.51.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,System.IO.Abstractions.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,System.IO.Pipelines,7.0.0.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,System.IO.Pipelines.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,System.IdentityModel.Tokens.Jwt,6.32.0.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,System.IdentityModel.Tokens.Jwt.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,System.Management,7.0.1.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,System.Management.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,TestableIO.System.IO.Abstractions,19.2.51.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,TestableIO.System.IO.Abstractions.Wrappers.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,TestableIO.System.IO.Abstractions.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP,0.23082.41.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.Auth,0.23082.41.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.Auth.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.Common,0.23082.41.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.Common.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.Onboarding,0.23082.41.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.Onboarding.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.PhoneLink,0.23082.41.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.PhoneLink.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.PlatformSdk,0.23082.41.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.PlatformSdk.Protocol,0.23082.41.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.PlatformSdk.Protocol.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.PlatformSdk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.ServicesClient,0.23082.41.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.ServicesClient.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.SideChannel,0.23082.41.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.SideChannel.Protocol,0.23082.41.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.SideChannel.Protocol.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.SideChannel.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\NetFramework\BreadcrumbStore\netcore,YourPhone.YPP.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Network\Downloader\edb.chk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Network\Downloader\edb.log.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Network\Downloader\edb00001.log.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Network\Downloader\edbres00001.jrs.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Network\Downloader\edbres00002.jrs.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Network\Downloader\edbtmp.log.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Network\Downloader\qmgr.db.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Office\ClickToRunPackageLocker.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
modified
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.1.Crwl.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.1.gthr.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.2.Crwl.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.2.gthr.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.3.Crwl.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.3.gthr.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.000.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.001.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.002.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.000.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.001.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.002.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.jfm.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb.jcp.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb.jtx.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb00012.jtx.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb00013.jtx.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edb00014.jtx.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edbres00001.jrs.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edbres00002.jrs.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\edbtmp.jtx.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\tmp.edb.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.jfm.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\DesktopSettings2013.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\EaseOfAccessSettings2013.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftInternetExplorer2013Backup.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2010.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win32.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftLync2013Win64.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftNotepad.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win32.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2010Win64.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin32.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013BackupWin64.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win32.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Office365Win64.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win32.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2013Win64.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin32.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016BackupWin64.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win32.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOffice2016Win64.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin32.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin32.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2013CAWin64.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin32.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftOutlook2016CAWin64.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win32.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftSkypeForBusiness2016Win64.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\MicrosoftWordpad.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\NetworkPrinters.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\RoamingCredentialSettings.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\ThemeSettings2013.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\ThemeSettings2013.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\InboxTemplates\VdiState.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate.xsd.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013.xsd.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\UEV\Templates\SettingsLocationTemplate2013A.xsd.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\User Account Pictures\guest.png.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\User Account Pictures\hardz.dat.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\User Account Pictures\jones.dat.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\User Account Pictures\user.dat.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\User Account Pictures\user-192.png.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\User Account Pictures\user-192.png.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\User Account Pictures\user-32.png.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\User Account Pictures\user-32.png.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\User Account Pictures\user-40.png.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\User Account Pictures\user-40.png.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\User Account Pictures\user-48.png.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\User Account Pictures\user-48.png.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\User Account Pictures\user.bmp.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\User Account Pictures\user.png.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\154E23D0-C644-4E6F-8CE6-5069272F999F.vsch.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\2F1A6504-0641-44CF-8BB5-3612D865F2E5.vsch.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\3CCD5499-87A8-4B10-A215-608888DD3B55.vsch.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\Policy.vpol.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\Policy.vpol.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Vault\AC658CB4-9126-49BD-B877-31EEDAB3F204\Policy.vpol_.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpasdlta.lkg.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpasdlta.vdm.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpavdlta.lkg.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpavdlta.vdm.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.lkg.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Catalogs\IGD.CAT.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ConfigSecurityPolicy.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\DefenderCSP.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Drivers\WdBoot.sys.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Drivers\WdDevFlt.sys.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Drivers\WdFilter.sys.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Drivers\WdNisDrv.sys.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Microsoft-Antimalware-NIS.man.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Microsoft-Antimalware-RTP.man.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpAsDesc.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpAzSubmit.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpClient.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCmdRun.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCommu.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpCopyAccelerator.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDetours.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDetoursCopyAccelerator.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpDlpCmd.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpEvMsg.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpOAV.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpRtp.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpSenseComm.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpSvc.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpUpdate.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MpUxAgent.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpLics.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\NisSrv.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Powershell\Defender.psd1.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\Powershell\MSFT_MpScan.cdxml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
modified
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ThirdPartyNotices.txt.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpAsDesc.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpClient.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpCmdRun.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpDetours.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MpOAV.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\MsMpLics.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\en-GB\mpasdesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\en-US\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\X86\endpointdlp.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\af-ZA\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\am-ET\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ar-SA\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ar-SA\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\as-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\az-Latn-AZ\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\bg-BG\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\bg-BG\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\bn-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\bs-Latn-BA\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ca-ES\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ca-ES\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\cs-CZ\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\cs-CZ\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\cs-CZ\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\cy-GB\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\da-DK\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\da-DK\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\da-DK\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\de-DE\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\de-DE\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\de-DE\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\el-GR\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\el-GR\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\el-GR\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\en-GB\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\en-GB\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\en-US\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\en-US\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\en-US\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\endpointdlp.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\es-ES\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\es-ES\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\es-ES\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\es-MX\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\es-MX\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\et-EE\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\et-EE\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\eu-ES\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fa-IR\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fi-FI\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fi-FI\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fi-FI\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fil-PH\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fr-CA\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fr-CA\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fr-FR\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fr-FR\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\fr-FR\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ga-IE\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\gd-GB\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\gl-ES\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\gu-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\he-IL\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\he-IL\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hi-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hr-HR\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hr-HR\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hu-HU\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hu-HU\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\hu-HU\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\id-ID\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\id-ID\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\is-IS\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\it-IT\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\it-IT\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\it-IT\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ja-JP\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ja-JP\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ja-JP\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ka-GE\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\kk-KZ\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\km-KH\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\kn-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ko-KR\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ko-KR\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ko-KR\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\kok-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\lb-LU\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\lo-LA\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\lt-LT\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\lt-LT\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\lv-LV\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\lv-LV\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mi-NZ\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mk-MK\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ml-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mpextms.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mr-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ms-MY\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\mt-MT\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\nb-NO\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\nb-NO\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\nb-NO\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ne-NP\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\nl-NL\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\nl-NL\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\nl-NL\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\nn-NO\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\or-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\pa-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\pl-PL\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\pl-PL\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\pl-PL\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ru-RU\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sk-SK\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sk-SK\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sl-SI\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sl-SI\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sq-AL\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sr-Cyrl-BA\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sr-Cyrl-RS\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sr-Latn-RS\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sr-Latn-RS\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sv-SE\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sv-SE\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\sv-SE\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ta-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\te-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\th-TH\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\th-TH\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\tr-TR\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\tr-TR\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\tr-TR\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\tt-RU\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ug-CN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\uk-UA\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\uk-UA\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\ur-PK\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\vi-VN\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\vi-VN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-CN\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-CN\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-CN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-TW\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-TW\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\zh-TW\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Catalogs\IGD.CAT.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ConfigSecurityPolicy.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\DefenderCSP.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Drivers\WdBoot.sys.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Drivers\WdDevFlt.sys.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Drivers\WdFilter.sys.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Drivers\WdNisDrv.sys.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Microsoft-Antimalware-NIS.man.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Microsoft-Antimalware-RTP.man.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpAsDesc.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpAzSubmit.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpClient.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCmdRun.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCommu.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpCopyAccelerator.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDefenderCoreService.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDetours.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDetoursCopyAccelerator.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDlp.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpDlpCmd.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpEvMsg.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpOAV.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpRtp.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpSenseComm.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpSvc.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpUpdate.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MpUxAgent.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpEng.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\MsMpLics.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\NisSrv.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Powershell\Defender.psd1.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\Powershell\MSFT_MpScan.cdxml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ProtectionManagement.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ProtectionManagement.mof.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ThirdPartyNotices.txt.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpAsDesc.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpClient.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpCmdRun.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpDetours.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MpOAV.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\MsMpLics.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\en-GB\mpasdesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\en-US\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\X86\endpointdlp.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\af-ZA\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\am-ET\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ar-SA\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ar-SA\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\as-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\az-Latn-AZ\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\bg-BG\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\bg-BG\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\bn-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\bs-Latn-BA\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ca-ES\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ca-ES\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\cs-CZ\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\cs-CZ\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\cs-CZ\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\cy-GB\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\da-DK\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\da-DK\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\da-DK\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\de-DE\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\de-DE\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\de-DE\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\el-GR\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\el-GR\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\el-GR\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\en-GB\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\en-GB\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\en-US\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\en-US\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\en-US\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\endpointdlp.dll.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\es-ES\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\es-ES\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\es-ES\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\es-MX\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\es-MX\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\et-EE\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\et-EE\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\eu-ES\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fa-IR\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fi-FI\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fi-FI\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fi-FI\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fil-PH\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fr-CA\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fr-CA\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fr-FR\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fr-FR\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\fr-FR\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ga-IE\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\gd-GB\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\gl-ES\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\gu-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\he-IL\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\he-IL\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hi-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hr-HR\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hr-HR\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hu-HU\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hu-HU\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\hu-HU\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\id-ID\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\id-ID\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\is-IS\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\it-IT\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\it-IT\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\it-IT\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ja-JP\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ja-JP\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ja-JP\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ka-GE\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\kk-KZ\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\km-KH\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\kn-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ko-KR\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ko-KR\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ko-KR\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\kok-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\lb-LU\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\lo-LA\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\lt-LT\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\lt-LT\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\lv-LV\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\lv-LV\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mi-NZ\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mk-MK\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ml-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mpextms.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mr-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ms-MY\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\mt-MT\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\nb-NO\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\nb-NO\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\nb-NO\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ne-NP\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\nl-NL\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\nl-NL\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\nl-NL\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\nn-NO\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\or-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pa-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pl-PL\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pl-PL\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pl-PL\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pt-BR\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pt-BR\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pt-BR\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pt-PT\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pt-PT\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\pt-PT\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\quz-PE\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ro-RO\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ro-RO\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ru-RU\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ru-RU\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ru-RU\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sk-SK\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sk-SK\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sl-SI\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sl-SI\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sq-AL\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sr-Cyrl-BA\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sr-Cyrl-RS\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sr-Latn-RS\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sr-Latn-RS\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sv-SE\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sv-SE\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\sv-SE\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ta-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\te-IN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\th-TH\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\th-TH\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\tr-TR\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\tr-TR\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\tr-TR\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\tt-RU\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ug-CN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\uk-UA\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\uk-UA\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\ur-PK\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\vi-VN\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\vi-VN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\zh-CN\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\zh-CN\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\zh-CN\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\zh-TW\MpAsDesc.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\zh-TW\MpEvMsg.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.23090.2008-0\zh-TW\mpuxagent.dll.mui.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Scans\History\ReportLatency\Latency\01\2.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Scans\History\ReportLatency\Latency\19\0.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Scans\History\ReportLatency\Latency\19\1.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Detections.log.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Detections.log.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\History.Log.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\History.Log.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Unknown.Log.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\Unknown.Log.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\3846C1B485BFA46E3AB54DFBE9D1DE49.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\56598B41F139620898884E49C611C148.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\81FE2459AB45799D6C1FB53DEEE30AF6.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\93BCA88018E5993458BC6BBE55D33E61.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\9BBF8E3725F51A366740AC59C8CBB345.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\A0137882FC829131E8629036339BD1FB.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Scans\History\Store\C73297F3A28B41D0B045DECE1D0D81EF.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Scans\MpDiag.bin.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Scans\MpDiag.bin.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Support\MPDetection-20231003-085557.log.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Support\MPDetection-20231003-085557.log.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Support\MPDeviceControl-20231003-122002.log.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-20231003-085557.log.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-GB\confident.cov.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-GB\fyi.cov.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-GB\generic.cov.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows NT\MSFax\Common Coverpages\en-GB\urgent.cov.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-GB\WelcomeFax.tif.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\AppxProvisioning.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\02305155-8ac1-1189-ff55-b7119a53887c.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\02305155-8ac1-1189-ff55-b7119a53887c.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\03f8974b-362e-33e3-2e0b-c7bc2ea01c63.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\0890ad2f-b74f-c384-f684-9c33f8f67924.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\0890ad2f-b74f-c384-f684-9c33f8f67924.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\0a8c1492-65ca-6a01-de25-0e183559d10d.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\0a8c1492-65ca-6a01-de25-0e183559d10d.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\0f8e2cd5-b8eb-7a22-b9e9-9b1183fa0a84.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\13edb933-4688-0f79-3d0a-499edf952ba0.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\13edb933-4688-0f79-3d0a-499edf952ba0.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\1659a225-428e-84f0-ba52-5fb2b85d55b3.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\18549a9c-bedc-b855-f0e6-0787d8b3300d.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\18549a9c-bedc-b855-f0e6-0787d8b3300d.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\1e225998-faa0-5fd4-4db7-5e7686ee3b47.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\1e77870d-1a93-60e5-ffda-9653c7cad20a.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\1f7b7aa2-506a-03cd-6648-5b78ac12040f.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\1faf63f7-f387-4522-1175-68c9652d968a.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\215f9712-9fca-a3f8-5b11-660eefc73b96.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\26943e1f-42ed-f190-2895-3bc2b8c4176d.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\280b97f1-1f94-1458-c842-d18e2d1e05f9.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\28502d06-9d29-8514-1e5d-64447116d798.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\28748306-9f02-a5d7-6ded-4459fddadc31.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\292d761b-1fa7-9c70-1afd-c2e4040b6577.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\2b5d0f60-d93b-1629-f3e5-4167231c7ee6.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\2ff6ba33-4212-e6d3-dcc2-11aadb3d61ef.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\306e67c8-9a1d-38de-8654-054bd8a6e6d6.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\38ae356e-4b11-78bd-6f1e-d1fbd81b826a.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\3c8c7eb3-7a1d-7981-0472-571cdd1d1292.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\3f446420-d8ef-3b9c-d5b4-ba09c43121b4.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\42180d93-7e2c-7efa-09ed-dfdffa034b8e.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\436e78a7-dabb-5a30-f98d-963a03bf8af1.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\4c4ecbc0-0ec0-3929-aebb-a931a339fb23.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\517cfcaf-138b-1796-2cea-62892204250a.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\52a7e8cc-4b89-0eb8-5b4c-0f924bfc3949.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\5c834b0b-64f8-6383-854a-915ac7ddab77.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\61b5bd89-4cb0-db77-6622-cb63b5a58080.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\630a70e7-1832-4f42-e2a2-5d35fdddc45f.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\67447b0c-05cf-6740-5f7b-391ab440c42d.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\6ab96728-2783-240f-370f-afa9d4e52fdd.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\6e90ed81-9187-fa62-ce90-f18d7bed6b12.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\6ffa25dc-c89d-3de9-3601-df09bae65a75.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\71c8f37a-a7b9-aff0-6de0-9b276c089ad6.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\71ef3df1-f4b1-69cd-793a-48e165e282aa.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\7309084a-bb6f-20c3-ea54-aa108ceab1ae.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\7646fa0f-b52c-71a8-3aed-950dd1668c09.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\8292682a-6850-c06c-9b6d-9646f16d4ed0.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\832f9d1e-5f47-dfb1-157b-5239adf4c1db.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\865e8f30-20a1-9528-bb48-42999b5b2aa8.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\8ce3d3dd-a4c7-6c38-5fde-1f9f5df98807.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\8cfc804a-d777-2361-1670-4569e516397e.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\8d56e57b-8663-136d-ff69-a004e217825a.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\8e383e90-b2f9-7bf2-1d5b-4e47dcb2014e.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\91a5b4c7-29a8-ec80-4321-fbecea906705.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\9a9f1e94-851b-c6b4-27c0-55a242e0d96d.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\9d3ad23c-c6b8-7fb5-e4ab-f5d0a66dcfbc.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\a1e5b165-0532-a6a3-f542-0c5c162be3e1.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\a7e08b8b-ad4b-af00-ebcc-1aa29a833ce9.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\a92561ce-87c0-7d40-42ea-c87d237c0db0.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\abbb44f6-ae33-2e7c-ac40-4d8ac17bf46b.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\ac116a72-b6b1-d558-23f6-10796e634d41.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\b34b197c-c0ed-bf12-c9bb-44e883c66a9d.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\b59f5123-f94a-28bc-cf2d-1f77c3cd60ad.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\b6126597-8ecb-81b4-8b3a-1430dc2988c1.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\b81d7e70-84e7-b16a-e3d0-1e7aa2f1232d.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\bb26a0e5-d235-0ee6-0c36-6d5e185fa5b1.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\bbfbe8ad-1a35-a7f3-33bc-40912bf89dfb.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\bcda97bb-bfd0-2a72-3c90-c8518f3d09ee.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\c3d42a1a-2f3f-a4a9-6a04-cc1b234485fb.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\c94a6c18-d496-da1c-8a02-fc6976e0145e.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\ca947da2-7e9a-7249-8095-bceb379c6f74.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\cb692946-a9f3-639d-1064-a6d75a01b9c3.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\d1ecfce2-f845-c1e9-052b-d2f457c135e6.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\d834be1c-66d4-85d2-5bfc-720e73e8e544.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\e2a686b1-b02a-b3e7-90cb-3fa0d708ce04.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\e64ffef1-e246-b632-595b-56076a3fa776.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\e78cdb72-8076-1aa5-5df6-048300a0f594.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\e8ac9388-7c9c-19cc-fd4d-cb72bb1544ea.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\e8fff2df-6041-8f21-3df7-db31661aa09b.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\e9bff135-4a26-0e2f-d743-30d9666eed8e.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\ea39969e-9808-10a2-23ff-be783a132fea.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\ecbc2601-0a67-4963-e594-43c65d6ec9a5.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\eee47229-947d-2ac7-e8a3-49bafee251d1.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\f1d940d0-b5b2-0083-8403-807a8db430d5.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\f5fc8c03-78f6-342c-372b-15d02609bd3c.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\Archive\Apps\fc93b452-8a84-dede-3b7a-0fc9413c4592.xml.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\ClipSVC\tokens.dat.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\DeviceMetadataCache\dmrc.idx.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\LfSvc\Geofence\GeofenceApplicationID.dat.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\LfSvc\Geofence\GeofenceApplicationID.dat.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\OneSettings\ASAP_CloudPolicy.json.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\OneSettings\ASAP_CloudPolicy.json.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\OneSettings\CTAC.json.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\OneSettings\CortanaUWP.json.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\OneSettings\CortanaUWP.json.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\OneSettings\DirectXDbVersion.json.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\OneSettings\DirectXDbVersion.json.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\OneSettings\FeatureConfig.json.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\OneSettings\SCCInstallService.json.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\OneSettings\SCCInstallService.json.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\OneSettings\StorageGroveler.json.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\OneSettings\StorageGroveler.json.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\OneSettings\TroubleshootingSvc.json.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\OneSettings\TroubleshootingSvc.json.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\OneSettings\UsoSettings.json.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\OneSettings\UsoSettings.json.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\OneSettings\config.json.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip Help.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip Help.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Access.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Speech Recognition.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Math Input Panel.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Notepad.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Paint.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Quick Assist.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Remote Desktop Connection.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Snipping Tool.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Steps Recorder.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Character Map.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Fax and Scan.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Media Player.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Wordpad.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Wordpad.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Component Services.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Computer Management.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Disk Cleanup.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Event Viewer.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Memory Diagnostics Tool.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\ODBC Data Sources (32-bit).lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\ODBC Data Sources (64-bit).lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Performance Monitor.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Print Management.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\RecoveryDrive.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Registry Editor.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Resource Monitor.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Security Configuration Management.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Configuration.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\System Information.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Task Scheduler.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\dfrgui.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\iSCSI Initiator.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\AutoIt Help File.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\AutoIt Window Info (x64).lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\AutoIt Window Info (x86).lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Check For SQLite Updates.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Check For Updates.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Compile Script to .exe (x64).lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Compile Script to .exe (x86).lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Examples.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Examples.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoIt v3 Website.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoIt v3 Website.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX\AutoItX Help File.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\AutoItX\AutoItX Help File.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\Browse Extras.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\Browse Extras.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Run Script (x64).lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Run Script (x64).lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Run Script (x86).lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Run Script (x86).lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\SciTE Script Editor.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AutoIt v3\SciTE Script Editor.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Excel.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox Private Browsing.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox Private Browsing.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Firefox.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Immersive Control Panel.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\About Java.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\About Java.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Check For Updates.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Check For Updates.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Configure Java.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Configure Java.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.url.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Get Help.url.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Visit Java.com.url.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java\Visit Java.com.url.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Edge.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Database Compare.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Database Compare.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Office Language Preferences.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Skype for Business Recording Manager.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Spreadsheet Compare.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Spreadsheet Compare.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Tools\Telemetry Log for Office.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OneNote.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Outlook.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerPoint.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publisher.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype for Business.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype for Business.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Task Manager.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Task Manager.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell ISE (x86).lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell ISE.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell ISE.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Word.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Microsoft\Windows\wfp\wfpdiag.etl.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\UpdateLock-308046B0AF4A39CB.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\VC_redist.x64.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\state.rsm.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\Package Cache\{8bdfe669-9705-4184-9368-db9ce581e0e7}\state.rsm.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\TightVNC\tvnserver.log.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\USOShared\Logs\User\NotifyIcon.0884f9b2-b6ec-4b87-899f-510361add0dc.1.etl.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\USOShared\Logs\User\NotifyIcon.1d47542d-bdee-4dc6-94ed-be9cdb6f14e1.1.etl.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\USOShared\Logs\User\NotifyIcon.21a55447-0332-4ea2-8e22-8ddd09981184.1.etl.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\USOShared\Logs\User\NotifyIcon.38fad0bf-4730-4bc4-be22-5277e88811cd.1.etl.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\USOShared\Logs\User\NotifyIcon.480bc3f4-4991-4ffc-b70d-c15db82e9d6a.1.etl.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\USOShared\Logs\User\NotifyIcon.a686e598-6877-4264-9711-989651a302f7.1.etl.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\USOShared\Logs\User\NotifyIcon.a821f645-76e8-4ba9-965c-60ad931c30ce.1.etl.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\USOShared\Logs\User\NotifyIcon.c6e0f9e8-f670-49c4-974e-9d40568a1011.1.etl.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\USOShared\Logs\User\NotifyIcon.d9261b8a-d5e2-42ed-ab32-cd2fab1962fc.1.etl.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\USOShared\Logs\User\NotifyIcon.e99a38d9-255f-44d4-9ce1-275e8cf23855.1.etl.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\USOShared\Logs\User\NotifyIcon.f3f7cc8e-795b-4925-9b8c-26e2ea300f41.1.etl.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\USOShared\Logs\User\NotifyIcon.f4d4c9b8-57b5-43ca-ab7a-5d857e7666b9.1.etl.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\USOShared\Logs\User\NotifyIcon.fbe50464-f61d-4a15-a5b7-ed239a079807.1.etl.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\USOShared\Logs\User\UpdateUx.475a5b13-420d-4358-9fdb-c77913ec90af.1.etl.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\_curlrc.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtag.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Users\Public\Desktop\Adobe Acrobat.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Users\Public\Desktop\Adobe Acrobat.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Users\Public\Desktop\Firefox.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Users\Public\Desktop\Firefox.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Users\Public\Desktop\Google Chrome.lnk.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Users\Public\Desktop\Google Chrome.lnk.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Users\Public\Desktop\desktop.ini.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Users\Public\Desktop\desktop.ini.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Users\Public\Documents\desktop.ini.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Users\Public\Documents\desktop.ini.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Users\Public\Music\desktop.ini.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Users\Public\Music\desktop.ini.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Users\Public\Pictures\desktop.ini.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Users\Public\Pictures\desktop.ini.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Users\Public\Videos\desktop.ini.exe.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
C:\Users\Public\Videos\desktop.ini.tmp
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious
There are 2006 hidden files, click here to show them.