Corvus_ - Report #11149

Report #11149

Creation Date: Sept. 8, 2020, 1:40 a.m.
Last Update: Sept. 8, 2020, 1:44 a.m.
File: 048
Results:

General
Static
Detection
Dynamic
Graph
Network
Classification

Binary

DLL

False

Size

1.17MB

trid

61.8% Win32 Executable MS Visual C++
13.0% Win32 Dynamic Link Library
8.9% Win32 Executable
4.1% Win16/32 Executable Delphi generic
4.0% OS/2 Executable

type

wordsize

Subsystem

Windows GUI

Hashes

md5

8ba8a22ba30e2dd2eb69bb9f50841ee3

sha1

2f0046fc80d6aad6464f1c064873aa7becd540cd

crc32

0xfbe836f2

sha224

311caedd26dcb35090b4ef7fa176b1c9e62755d17cff6dcb88ba97ae

sha256

2923b0d410dc2b3827f3c66ed06aac9247f7038a0e95a6328bc7d1c8da4c570b

sha384

69e1016fd09a03107fcf99f43754d10aff308983510887423c21deef637e3f246d747d49f389f9dab2f87201c96abe38

sha512

b66aa465d4c90277d499d39f16464d9895c3a7cb8de3ccfd2d619da2331859d91275727d7794509f3b3080afef17e13c55e18414e6e01ab0e1e4b74e7df05954

ssdeep

3072:0jY9xJ5k3v3v3v3v3v3v3v3v3v3v3v3v3v3v3v3v3v3v3v3v3v3v3v3v3v3v3veX:v9DeCBa1kf0A

Community

Google

False

HashLib

False

YARA

Matches

domain, contentis_base64, Check_OutputDebugStringA_iat, HasDigitalSignature, screenshot, url, win_token, win_mutex, win_registry, Microsoft_Visual_Cpp_v50v60_MFC, HasOverlay, win_files_operation, IsPE32, anti_dbg, IsWindowsGUI, IP

Suspicious

True

Strings

List

,https://www.example.com/my_product/info.html0
siy.al
wmlaunch.exe
wmlaunch.exe
name="Microsoft.Windows.MediaPlayer.WMLaunch"
co0.ec:
$11w.ro
COMCTL32.dll
Cla/eHw.dlk
RinterfacE\{b196b287-bab4-101a-b69c-00aa00341d07}
`E>8ra%8Fi"iNa
0d]%e
*tmg%naT_s
ro%Edd
<description>Windows Media Player Launcher</description>
]AuzgRu`Cmd
0aTCpaEMUAEJ
<requestedPrivileges>
Windows Media Player Launcher
GetProcAddress
ExitProcess
CreateEventW
SetWinEventHook
DDPIgVncJv
GetForegroundWindow
SuspendThread
CreateProcessW
CreateProcessA
TerminateProcess
OpenProcessToken
DeviceIoControl
ShellExecuteExW
VirtualAlloc
CoCreateInstance
VirtualAlloc
MapViewOfFileEx
MapViewOfFile
VirtualProtect
ControlService
CreateDirectoryW
GetModuleHandleA
RegOpenKeyW
DeleteFileW
RegCreateKeyExW
CreateFileMappingA
RegQueryValueExW
LoadLibraryA
RemoveDirectoryA
RegDeleteValueW
OpenServiceW
LoadResource
CreateMutexW
OpenSCManagerW
StartServiceW
QueryPerformanceCounter
RegOpenKeyExA
DeleteService
GetModuleFileNameA
RemoveDirectoryW
GetModuleFileNameW
HeapCreate
SetFilePointer
RegQueryValueExA
RegOpenKeyExW
CreateDirectoryA
FreeLibrary
LoadLibraryExW
CopyFileW
FindNextFileW
GetModuleHandleW
RegSetValueExW
FindFirstFileW
WriteFile
CreateFileW
LoadLibraryW
CreateFileA
RegDeleteKeyW
MoveFileExW
CreateFileMappingW
ReadFile
Microsoft Corporation. All rights reserved.
GetTickCount
he wYBbqVS
Sleep
GetDC
<requestedExecutionLevel
GetConsoleOutputCP
GetCPInfo
GetProcessHeap
EN3D$N5E
version="5.1.0.0"
ap!6tPe
1"12g-roeZss
q$11g.rouYss
__E)t_'4p_
Z2WaPra_es
be6vun&kn
<FibaPc5
"10w9et
"10w9et

Foremost

Matches

0.exe, 1 MB

Suspicious

True

Heuristics

IPs

hasIPs: False
Allowed
Suspicious
hasAllowed: False
hasSuspicious: False

URLs

Allowed
hasURLs: True
Suspicious: https://www.example.com/my_product/info.html0
hasAllowed: False
hasSuspicious: True

Files

Allowed: ADVAPI32.dll, ole32.dll, SHELL32.dll, COMCTL32.dll, COMDLG32.dll, GDI32.dll, USER32.dll, KERNEL32.dll
hasFiles: True
Suspicious
hasAllowed: True
hasSuspicious: False

Binary

Sizes

RVA
RVA: 16
Suspicious: False
Code
Size: 802304
Suspicious: False
Image
Address: 4194304
Suspicious: False
Stack
Stack: 4096
Suspicious: False
Headers
Headers: 1024
Suspicious: False
Suspicious: False

Symbols

Number
Number: 0
Suspicious: True
Pointer
Pointer: 0
Suspicious: True
Directories
Number: 16
Suspicious: False

Checksum

Value: 1256702
Suspicous: False

Sections

Allowed: .text, .data, .rdata8, .rsrc
Suspicious
hasAllowed: True
hasSections: True
hasSuspicious: False

Versions

OS
Version: 4
Suspicious: False
Image
Version: True
Suspicious: 4
Linker
Version: 2.50
Suspicious: False
Subsystem
Version: 4.0
Suspicious: False
Suspicious: False

EntryPoint

Address: 419200
Suspicious: False

Anomalies

Anomalies
hasAnomalies: False

Libraries

Allowed: advapi32.dll, ole32.dll, shell32.dll, comctl32.dll, comdlg32.dll, gdi32.dll, user32.dll, kernel32.dll
hasLibs: True
Suspicious
hasAllowed: True
hasSuspicious: False

Timestamp

Past: False
Valid: True
Value: 2020-07-28 23:33:49
Future: False

Compilation

Packed: False
Missing: True
Packers
Compiled: False
Compilers

Obfuscation

XOR: False
Fuzzing: False

PEDetector

Matches

None

Suspicious

False

Disassembly

hasTricks

True

Tricks

pushret

.data: 16
.text: 1

pushpopmath

.data: 22
.text: 1

garbagebytes

.data: 4
.text: 1

programcontrolflowchange

.data: 4
.text: 1

cpuinstructionsresultscomparison

.data: 3

AVclass

bobik

VirusTotal

md5

8ba8a22ba30e2dd2eb69bb9f50841ee3

sha1

2f0046fc80d6aad6464f1c064873aa7becd540cd

SCANS

AVG

result: Win32:DangerousSig [Trj]
update: 20200806
version: 18.4.3895.0
detected: True

CMC

update: 20200805
version: 2.7.2019.1
detected: False

MAX

result: malware (ai score=89)
update: 20200806
version: 2019.9.16.1
detected: True

APEX

result: Malicious
update: 20200804
version: 6.56
detected: True

Bkav

result: W32.AIDetectVM.malware2
update: 20200806
version: 1.3.0.9899
detected: True

K7GW

result: Trojan ( 005652be1 )
update: 20200806
version: 11.128.34909
detected: True

ALYac

result: Gen:Variant.Razy.725518
update: 20200806
version: 1.1.1.5
detected: True

Avast

result: Win32:DangerousSig [Trj]
update: 20200806
version: 18.4.3895.0
detected: True

Avira

result: TR/Kryptik.kdxer
update: 20200806
version: 8.3.3.8
detected: True

Baidu

update: 20190318
version: 1.0.0.2
detected: False

Cynet

result: Malicious (score: 85)
update: 20200806
version: 4.0.0.24
detected: True

Cyren

result: W32/Trojan.MSQE-8110
update: 20200806
version: 6.3.0.2
detected: True

DrWeb

update: 20200806
version: 7.0.46.3050
detected: False

GData

result: Gen:Variant.Razy.725518
update: 20200806
version: A:25.26487B:27.19700
detected: True

Panda

result: Trj/GdSda.A
update: 20200805
version: 4.6.4.2
detected: True

VBA32

result: BScope.Trojan.Inject
update: 20200805
version: 4.4.1
detected: True

VIPRE

result: Trojan.Win32.Generic!BT
update: 20200806
version: 85730
detected: True

Zoner

update: 20200806
version: 0.0.0.0
detected: False

ClamAV

update: 20200805
version: 0.102.4.0
detected: False

Comodo

update: 20200728
version: 32668
detected: False

F-Prot

update: 20200806
version: 4.7.1.166
detected: False

Ikarus

result: Trojan-Spy.Agent
update: 20200805
version: 0.1.5.2
detected: True

McAfee

result: Packed-GBS!8BA8A22BA30E
update: 20200806
version: 6.0.6.653
detected: True

Rising

result: Trojan.Kryptik!1.C974 (CLOUD)
update: 20200806
version: 25.0.0.26
detected: True

Sophos

result: Mal/EncPk-APV
update: 20200806
version: 4.98.0
detected: True

Yandex

update: 20200707
version: 5.5.2.24
detected: False

Zillya

result: Downloader.Deyma.Win32.166
update: 20200805
version: 2.0.0.4148
detected: True

Acronis

update: 20200603
version: 1.1.1.76
detected: False

Alibaba

result: Trojan:Win32/Kryptik.a56dbe92
update: 20190527
version: 0.3.0.5
detected: True

Arcabit

result: Trojan.Razy.DB120E
update: 20200806
version: 1.0.0.877
detected: True

Cylance

result: Unsafe
update: 20200806
version: 2.3.1.101
detected: True

Endgame

result: malicious (high confidence)
update: 20200727
version: 4.0.6
detected: True

FireEye

result: Generic.mg.8ba8a22ba30e2dd2
update: 20200806
version: 32.36.1.0
detected: True

Sangfor

result: Malware
update: 20200423
version: 1.0
detected: True

TACHYON

update: 20200806
version: 2020-08-06.02
detected: False

Tencent

result: Malware.Win32.Gencirc.11a9aac1
update: 20200806
version: 1.0.0.1
detected: True

ViRobot

update: 20200806
version: 2014.3.20.0
detected: False

Webroot

update: 20200806
version: 1.0.0.403
detected: False

eGambit

update: 20200806
detected: False

Ad-Aware

result: Gen:Variant.Razy.725518
update: 20200806
version: 3.0.5.370
detected: True

AegisLab

result: Trojan.Win32.Bobik.l!c
update: 20200806
version: 4.2
detected: True

Emsisoft

result: Gen:Variant.Razy.725518 (B)
update: 20200806
version: 2018.12.0.1641
detected: True

F-Secure

result: Trojan.TR/Kryptik.kdxer
update: 20200806
version: 12.0.86.52
detected: True

Fortinet

result: W32/Cridex.VHO!tr
update: 20200806
version: 6.2.142.0
detected: True

Invincea

result: heuristic
update: 20200502
version: 6.3.6.26157
detected: True

Jiangmin

result: TrojanDownloader.Deyma.qq
update: 20200806
version: 16.0.100
detected: True

Kingsoft

update: 20200806
version: 2013.8.14.323
detected: False

Paloalto

result: generic.ml
update: 20200806
version: 1.0
detected: True

Symantec

result: ML.Attribute.HighConfidence
update: 20200806
version: 1.11.0.0
detected: True

Trapmine

update: 20200727
version: 3.5.0.1023
detected: False

AhnLab-V3

update: 20200806
version: 3.18.1.10026
detected: False

Antiy-AVL

result: Trojan[Downloader]/Win32.Deyma
update: 20200806
version: 3.0.0.1
detected: True

Kaspersky

result: Trojan-Spy.Win32.Bobik.ene
update: 20200806
version: 15.0.1.13
detected: True

Microsoft

result: Trojan:Win32/Cridex.AR!cert
update: 20200806
version: 1.1.17300.4
detected: True

Qihoo-360

result: Generic/HEUR/QVM20.1.E37E.Malware.Gen
update: 20200806
version: 1.0.0.1120
detected: True

ZoneAlarm

result: Trojan-Spy.Win32.Bobik.ene
update: 20200806
version: 1.0
detected: True

Cybereason

result: malicious.c80d6a
update: 20190616
version: 1.2.449
detected: True

ESET-NOD32

result: a variant of Win32/Kryptik.HFHM
update: 20200805
version: 21771
detected: True

TrendMicro

result: TROJ_GEN.R002C0PGT20
update: 20200806
version: 11.0.0.1006
detected: True

BitDefender

result: Gen:Variant.Razy.725518
update: 20200806
version: 7.2
detected: True

CrowdStrike

result: win/malicious_confidence_100% (W)
update: 20190702
version: 1.0
detected: True

K7AntiVirus

result: Trojan ( 005652be1 )
update: 20200806
version: 11.128.34910
detected: True

SentinelOne

result: DFI - Malicious PE
update: 20200725
version: 4.4.0.0
detected: True

Avast-Mobile

update: 20200806
version: 200806-00
detected: False

Malwarebytes

result: Spyware.PasswordStealer
update: 20200806
version: 3.6.4.335
detected: True

TotalDefense

update: 20200806
version: 37.1.62.1
detected: False

CAT-QuickHeal

result: Trojanspy.Bobik
update: 20200806
version: 14.00
detected: True

NANO-Antivirus

result: Trojan.Win32.Bobik.hpqiwf
update: 20200806
version: 1.0.134.25119
detected: True

BitDefenderTheta

result: Gen:NN.ZexaF.34152.kr1@aCYR!zei
update: 20200805
version: 7.2.37796.0
detected: True

MicroWorld-eScan

result: Gen:Variant.Razy.725518
update: 20200806
version: 14.0.409.0
detected: True

SUPERAntiSpyware

update: 20200731
version: 5.6.0.1032
detected: False

TrendMicro-HouseCall

result: TROJ_GEN.R002C0PGT20
update: 20200806
version: 10.0.0.1040
detected: True

total

sha256

2923b0d410dc2b3827f3c66ed06aac9247f7038a0e95a6328bc7d1c8da4c570b

scan_id

2923b0d410dc2b3827f3c66ed06aac9247f7038a0e95a6328bc7d1c8da4c570b-1596696221

resource

8ba8a22ba30e2dd2eb69bb9f50841ee3

permalink

https://www.virustotal.com/gui/file/2923b0d410dc2b3827f3c66ed06aac9247f7038a0e95a6328bc7d1c8da4c570b/detection/f-2923b0d410dc2b3827f3c66ed06aac9247f7038a0e95a6328bc7d1c8da4c570b-1596696221

positives

scan_date

2020-08-06 06:43:41

verbose_msg

Scan finished, information embedded

response_code

File

Trace

8/9/2020 - 0:45:42.762	Open	1480	C:\malware.exe	C:\ProgramData\a174c1ef10e2077451f5b6dda83242a1
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\a174c1ef10e2077451f5b6dda83242a1	a174c1ef10e2077451f5b6dda83242a1
8/9/2020 - 0:45:42.762	Unknown	1480	C:\malware.exe	C:\ProgramData\a174c1ef10e2077451f5b6dda83242a1	a174c1ef10e2077451f5b6dda83242a1
8/9/2020 - 0:45:42.762	Open	1480	C:\malware.exe	C:\ProgramData\a174c1ef10e2077451f5b6dda83242a1
8/9/2020 - 0:45:42.762	Unknown	1480	C:\malware.exe	C:\ProgramData\a174c1ef10e2077451f5b6dda83242a1	a174c1ef10e2077451f5b6dda83242a1
8/9/2020 - 0:45:42.762	Open	1480	C:\malware.exe	C:\ProgramData\a174c1ef10e2077451f5b6dda83242a1
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\a174c1ef10e2077451f5b6dda83242a1	a174c1ef10e2077451f5b6dda83242a1
8/9/2020 - 0:45:42.762	Unknown	1480	C:\malware.exe	C:\ProgramData\a174c1ef10e2077451f5b6dda83242a1	a174c1ef10e2077451f5b6dda83242a1
8/9/2020 - 0:45:42.762	Open	1480	C:\malware.exe	C:\ProgramData\a174c1ef10e2077451f5b6dda83242a1
8/9/2020 - 0:45:42.762	Unknown	1480	C:\malware.exe	C:\ProgramData\a174c1ef10e2077451f5b6dda83242a1	a174c1ef10e2077451f5b6dda83242a1
8/9/2020 - 0:45:42.762	Open	1480	C:\malware.exe	C:\ProgramData\AVAST Software
8/9/2020 - 0:45:42.762	Open	1480	C:\malware.exe	C:\ProgramData\Avira
8/9/2020 - 0:45:42.762	Open	1480	C:\malware.exe	C:\ProgramData\Kaspersky Lab
8/9/2020 - 0:45:42.762	Open	1480	C:\malware.exe	C:\ProgramData\ESET
8/9/2020 - 0:45:42.762	Open	1480	C:\malware.exe	C:\ProgramData\Panda Security
8/9/2020 - 0:45:42.762	Open	1480	C:\malware.exe	C:\ProgramData\Doctor Web
8/9/2020 - 0:45:42.762	Open	1480	C:\malware.exe	C:\ProgramData\AVG
8/9/2020 - 0:45:42.762	Open	1480	C:\malware.exe	C:\ProgramData\360TotalSecurity
8/9/2020 - 0:45:42.762	Open	1480	C:\malware.exe	C:\ProgramData\Bitdefender
8/9/2020 - 0:45:42.762	Open	1480	C:\malware.exe	C:\ProgramData\Norton
8/9/2020 - 0:45:42.762	Open	1480	C:\malware.exe	C:\ProgramData\Sophos
8/9/2020 - 0:45:42.762	Open	1480	C:\malware.exe	C:\ProgramData\Comodo
8/9/2020 - 0:45:42.762	Open	1480	C:\malware.exe	C:\programdata\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Open	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f
8/9/2020 - 0:45:42.762	Open	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f
8/9/2020 - 0:45:42.762	Unknown	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f
8/9/2020 - 0:45:42.762	Open	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f
8/9/2020 - 0:45:42.762	Unknown	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f
8/9/2020 - 0:45:42.762	Open	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Open	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.762	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.762	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.778	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.778	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Read	1480	C:\malware.exe	C:\malware.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Unknown	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Open	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe:Zone.Identifier
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe:Zone.Identifier
8/9/2020 - 0:45:42.903	Open	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Unknown	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Open	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Unknown	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Open	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:42.903	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:43.75	Write	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:43.262	Unknown	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:43.262	Open	1480	C:\malware.exe	C:\Windows\SysWOW64\apphelp.dll
8/9/2020 - 0:45:43.262	Open	1480	C:\malware.exe	C:\Windows\SysWOW64\apphelp.dll
8/9/2020 - 0:45:43.262	Open	1480	C:\malware.exe	C:\Windows\AppPatch\sysmain.sdb
8/9/2020 - 0:45:43.262	Open	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f
8/9/2020 - 0:45:43.262	Unknown	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f
8/9/2020 - 0:45:43.262	Open	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:43.262	Unknown	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:43.262	Open	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f
8/9/2020 - 0:45:43.262	Unknown	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f
8/9/2020 - 0:45:43.262	Open	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f
8/9/2020 - 0:45:43.262	Unknown	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f
8/9/2020 - 0:45:43.262	Open	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:43.262	Read	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:43.262	Open	1480	C:\malware.exe	C:\programdata\1321ba6d1f\ui\SwDRM.dll
8/9/2020 - 0:45:43.262	Open	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:43.262	Open	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:43.262	Unknown	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:43.262	Open	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:43.262	Unknown	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:43.262	Unknown	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:43.262	Read	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:43.262	Read	1480	C:\malware.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:43.262	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\Prefetch\BDIF.EXE-3877C1E9.pf
8/9/2020 - 0:45:43.262	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows
8/9/2020 - 0:45:43.262	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\System32\wow64.dll
8/9/2020 - 0:45:43.262	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\System32\wow64.dll
8/9/2020 - 0:45:43.262	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\System32\wow64win.dll
8/9/2020 - 0:45:43.262	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\System32\wow64win.dll
8/9/2020 - 0:45:43.262	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\System32\wow64cpu.dll
8/9/2020 - 0:45:43.262	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\System32\wow64cpu.dll
8/9/2020 - 0:45:43.262	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\System32\wow64log.dll
8/9/2020 - 0:45:43.262	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows
8/9/2020 - 0:45:43.262	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows
8/9/2020 - 0:45:43.278	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Monitor
8/9/2020 - 0:45:43.278	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\sechost.dll
8/9/2020 - 0:45:43.278	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\sechost.dll
8/9/2020 - 0:45:43.278	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\1321ba6d1f\bdif.exe.Local
8/9/2020 - 0:45:43.278	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc
8/9/2020 - 0:45:43.278	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc
8/9/2020 - 0:45:43.278	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc
8/9/2020 - 0:45:43.278	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
8/9/2020 - 0:45:43.278	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
8/9/2020 - 0:45:43.293	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:45:43.293	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:45:43.293	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:45:43.293	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:45:43.293	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:45:43.293	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:45:43.293	Unknown	1480	C:\malware.exe	C:\Windows
8/9/2020 - 0:45:43.293	Unknown	1480	C:\malware.exe	C:\Monitor
8/9/2020 - 0:45:43.293	Unknown	1480	C:\malware.exe	C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc
8/9/2020 - 0:45:43.293	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Monitor\4350ijy30u945j9f
8/9/2020 - 0:45:43.309	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Monitor\4350ijy30u945j9f
8/9/2020 - 0:45:43.309	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\Fonts\zZoddUUrBc
8/9/2020 - 0:45:43.309	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\1321ba6d1f\zZoddUUrBc
8/9/2020 - 0:45:43.309	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Monitor\zZoddUUrBc
8/9/2020 - 0:45:43.309	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\zZoddUUrBc
8/9/2020 - 0:45:43.309	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\system\zZoddUUrBc
8/9/2020 - 0:45:43.309	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\zZoddUUrBc
8/9/2020 - 0:45:43.309	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\zZoddUUrBc
8/9/2020 - 0:45:43.309	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\zZoddUUrBc
8/9/2020 - 0:45:43.309	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\wbem\zZoddUUrBc
8/9/2020 - 0:45:43.309	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\zZoddUUrBc
8/9/2020 - 0:45:43.309	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\Fonts\jsMbd Trk
8/9/2020 - 0:45:43.309	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\1321ba6d1f\jsMbd Trk
8/9/2020 - 0:45:43.309	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Monitor\jsMbd Trk
8/9/2020 - 0:45:43.309	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\jsMbd Trk
8/9/2020 - 0:45:43.309	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\system\jsMbd Trk
8/9/2020 - 0:45:43.309	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\jsMbd Trk
8/9/2020 - 0:45:43.309	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\jsMbd Trk
8/9/2020 - 0:45:43.309	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\jsMbd Trk
8/9/2020 - 0:45:43.309	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\wbem\jsMbd Trk
8/9/2020 - 0:45:43.309	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\jsMbd Trk
8/9/2020 - 0:45:43.325	Read	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:45:43.372	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\1321ba6d1f\WSOCK32.DLL
8/9/2020 - 0:45:43.372	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\wsock32.dll
8/9/2020 - 0:45:43.372	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\wsock32.dll
8/9/2020 - 0:45:43.372	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\a174c1ef10e2077451f5b6dda83242a1
8/9/2020 - 0:45:43.372	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\a174c1ef10e2077451f5b6dda83242a1	a174c1ef10e2077451f5b6dda83242a1
8/9/2020 - 0:45:43.372	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\a174c1ef10e2077451f5b6dda83242a1	a174c1ef10e2077451f5b6dda83242a1
8/9/2020 - 0:45:43.372	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\a174c1ef10e2077451f5b6dda83242a1
8/9/2020 - 0:45:43.387	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\a174c1ef10e2077451f5b6dda83242a1	a174c1ef10e2077451f5b6dda83242a1
8/9/2020 - 0:45:43.387	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\a174c1ef10e2077451f5b6dda83242a1
8/9/2020 - 0:45:43.387	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\a174c1ef10e2077451f5b6dda83242a1	a174c1ef10e2077451f5b6dda83242a1
8/9/2020 - 0:45:43.387	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\a174c1ef10e2077451f5b6dda83242a1	a174c1ef10e2077451f5b6dda83242a1
8/9/2020 - 0:45:43.387	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\a174c1ef10e2077451f5b6dda83242a1
8/9/2020 - 0:45:43.387	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\a174c1ef10e2077451f5b6dda83242a1	a174c1ef10e2077451f5b6dda83242a1
8/9/2020 - 0:45:43.387	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\AVAST Software
8/9/2020 - 0:45:43.387	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\Avira
8/9/2020 - 0:45:43.387	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\Kaspersky Lab
8/9/2020 - 0:45:43.387	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\ESET
8/9/2020 - 0:45:43.387	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\Panda Security
8/9/2020 - 0:45:43.387	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\Doctor Web
8/9/2020 - 0:45:43.387	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\AVG
8/9/2020 - 0:45:43.387	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\360TotalSecurity
8/9/2020 - 0:45:43.387	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\Bitdefender
8/9/2020 - 0:45:43.387	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\Norton
8/9/2020 - 0:45:43.387	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\Sophos
8/9/2020 - 0:45:43.387	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\Comodo
8/9/2020 - 0:45:43.387	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local\Temp\cred.dll
8/9/2020 - 0:45:43.387	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\1321ba6d1f\version.DLL
8/9/2020 - 0:45:43.387	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\version.dll
8/9/2020 - 0:45:43.387	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\version.dll
8/9/2020 - 0:45:43.387	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\Globalization\Sorting\SortDefault.nls
8/9/2020 - 0:45:43.387	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\Globalization\Sorting\SortDefault.nls	SortDefault.nls
8/9/2020 - 0:45:43.387	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\uxtheme.dll
8/9/2020 - 0:45:43.387	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\uxtheme.dll
8/9/2020 - 0:45:43.434	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\1321ba6d1f\api-ms-win-downlevel-shlwapi-l2-1-0.dll
8/9/2020 - 0:45:43.434	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
8/9/2020 - 0:45:43.434	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll	api-ms-win-downlevel-shlwapi-l2-1-0.dll
8/9/2020 - 0:45:43.434	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
8/9/2020 - 0:45:43.434	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll	api-ms-win-downlevel-shlwapi-l2-1-0.dll
8/9/2020 - 0:45:43.434	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\1321ba6d1f\Secur32.dll
8/9/2020 - 0:45:43.434	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\secur32.dll
8/9/2020 - 0:45:43.434	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\secur32.dll
8/9/2020 - 0:45:43.434	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files
8/9/2020 - 0:45:43.434	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files
8/9/2020 - 0:45:43.434	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\1321ba6d1f\api-ms-win-downlevel-advapi32-l2-1-0.dll
8/9/2020 - 0:45:43.434	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
8/9/2020 - 0:45:43.434	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll	api-ms-win-downlevel-advapi32-l2-1-0.dll
8/9/2020 - 0:45:43.434	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
8/9/2020 - 0:45:43.434	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll	api-ms-win-downlevel-advapi32-l2-1-0.dll
8/9/2020 - 0:45:43.481	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat
8/9/2020 - 0:45:43.481	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\winhttp.dll
8/9/2020 - 0:45:43.481	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\winhttp.dll
8/9/2020 - 0:45:43.481	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\webio.dll
8/9/2020 - 0:45:43.481	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\webio.dll
8/9/2020 - 0:45:43.481	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\1321ba6d1f\IPHLPAPI.DLL
8/9/2020 - 0:45:43.481	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\IPHLPAPI.DLL
8/9/2020 - 0:45:43.481	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\IPHLPAPI.DLL
8/9/2020 - 0:45:43.481	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\1321ba6d1f\WINNSI.DLL
8/9/2020 - 0:45:43.481	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\winnsi.dll
8/9/2020 - 0:45:43.481	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\winnsi.dll
8/9/2020 - 0:45:43.481	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\1321ba6d1f\DNSAPI.dll
8/9/2020 - 0:45:43.481	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\dnsapi.dll
8/9/2020 - 0:45:43.497	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\dnsapi.dll
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\mswsock.dll
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\mswsock.dll
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\wship6.dll
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\wship6.dll
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot
8/9/2020 - 0:45:43.543	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local
8/9/2020 - 0:45:43.543	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files
8/9/2020 - 0:45:43.543	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5
8/9/2020 - 0:45:43.543	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot
8/9/2020 - 0:45:43.543	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Roaming
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Roaming
8/9/2020 - 0:45:43.543	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Roaming
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Roaming\Microsoft\Windows\Cookies
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Roaming\Microsoft\Windows\Cookies
8/9/2020 - 0:45:43.543	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Roaming\Microsoft\Windows\Cookies
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Roaming\Microsoft\Windows\Cookies
8/9/2020 - 0:45:43.543	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Roaming\Microsoft\Windows\Cookies
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot
8/9/2020 - 0:45:43.543	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local
8/9/2020 - 0:45:43.543	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local\Microsoft\Windows\History
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local\Microsoft\Windows\History
8/9/2020 - 0:45:43.543	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local\Microsoft\Windows\History
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local\Microsoft\Windows\History\History.IE5
8/9/2020 - 0:45:43.543	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local\Microsoft\Windows\History\History.IE5
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\rpcss.dll
8/9/2020 - 0:45:43.543	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\rpcss.dll
8/9/2020 - 0:45:43.559	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\netprofm.dll
8/9/2020 - 0:45:43.559	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\netprofm.dll
8/9/2020 - 0:45:43.559	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\nlaapi.dll
8/9/2020 - 0:45:43.559	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\nlaapi.dll
8/9/2020 - 0:45:43.559	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\1321ba6d1f\dhcpcsvc6.DLL
8/9/2020 - 0:45:43.559	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\dhcpcsvc6.dll
8/9/2020 - 0:45:43.622	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\dhcpcsvc6.dll	dhcpcsvc6.dll
8/9/2020 - 0:45:43.622	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\dhcpcsvc6.dll
8/9/2020 - 0:45:43.622	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\dhcpcsvc6.dll	dhcpcsvc6.dll
8/9/2020 - 0:45:43.622	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\WSHTCPIP.DLL
8/9/2020 - 0:45:43.622	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\WSHTCPIP.DLL
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\1321ba6d1f\dhcpcsvc.DLL
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\dhcpcsvc.dll
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\dhcpcsvc.dll
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\1321ba6d1f\CRYPTSP.dll
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\cryptsp.dll
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\cryptsp.dll
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\rsaenh.dll
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\rsaenh.dll
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\rsaenh.dll
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\rsaenh.dll
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\rsaenh.dll
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\rsaenh.dll
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\rsaenh.dll
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\rsaenh.dll
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\rsaenh.dll
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\rsaenh.dll
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\rsaenh.dll
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\rsaenh.dll
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\1321ba6d1f\RpcRtRemote.dll
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\RpcRtRemote.dll
8/9/2020 - 0:45:43.668	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\RpcRtRemote.dll	RpcRtRemote.dll
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\RpcRtRemote.dll
8/9/2020 - 0:45:43.668	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\RpcRtRemote.dll	RpcRtRemote.dll
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\1321ba6d1f\rasadhlp.dll
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\rasadhlp.dll
8/9/2020 - 0:45:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\rasadhlp.dll
8/9/2020 - 0:45:43.778	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\npmproxy.dll
8/9/2020 - 0:45:43.778	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\npmproxy.dll
8/9/2020 - 0:45:43.825	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\FWPUCLNT.DLL
8/9/2020 - 0:45:43.825	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\FWPUCLNT.DLL
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\wininet.dll
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\1321ba6d1f\bdif.exe.Local
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d
8/9/2020 - 0:45:43.981	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\comctl32.dll
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\WindowsShell.Manifest
8/9/2020 - 0:45:43.981	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\WindowsShell.Manifest	WindowsShell.Manifest
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\ws2_32.dll
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\ws2_32.dll
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\WSHTCPIP.DLL
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\WSHTCPIP.DLL
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\WSHTCPIP.DLL
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\wship6.dll
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\wship6.dll
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\wship6.dll
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\wshqos.dll
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\wshqos.dll
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\wshqos.dll
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\wshqos.dll
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\wshqos.dll
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\wshqos.dll
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\wshqos.dll
8/9/2020 - 0:45:43.981	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\wshqos.dll
8/9/2020 - 0:45:44.840	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\wininet.dll
8/9/2020 - 0:45:44.840	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\wininet.dll
8/9/2020 - 0:46:29.122	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local\Temp\cred.dll
8/9/2020 - 0:46:43.465	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\1321ba6d1f\cmd.exe
8/9/2020 - 0:46:43.465	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Monitor\cmd.exe
8/9/2020 - 0:46:43.465	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\cmd.exe
8/9/2020 - 0:46:43.465	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\cmd.exe
8/9/2020 - 0:46:43.465	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\cmd.exe
8/9/2020 - 0:46:43.653	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\apphelp.dll
8/9/2020 - 0:46:43.653	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\apphelp.dll
8/9/2020 - 0:46:43.653	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\AppPatch\sysmain.sdb
8/9/2020 - 0:46:43.653	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:43.653	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:43.653	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\cmd.exe
8/9/2020 - 0:46:43.653	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\
8/9/2020 - 0:46:43.653	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\
8/9/2020 - 0:46:43.653	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows
8/9/2020 - 0:46:43.653	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows
8/9/2020 - 0:46:43.653	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:43.653	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:43.653	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:43.653	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:43.653	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\cmd.exe
8/9/2020 - 0:46:43.653	Read	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\cmd.exe
8/9/2020 - 0:46:43.653	Read	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\cmd.exe
8/9/2020 - 0:46:43.653	Read	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\cmd.exe
8/9/2020 - 0:46:43.653	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\ui\SwDRM.dll
8/9/2020 - 0:46:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\ProgramData\1321ba6d1f\REG.exe
8/9/2020 - 0:46:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Monitor\REG.exe
8/9/2020 - 0:46:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\reg.exe
8/9/2020 - 0:46:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\reg.exe
8/9/2020 - 0:46:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\reg.exe
8/9/2020 - 0:46:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\AppPatch\sysmain.sdb
8/9/2020 - 0:46:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:43.668	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\reg.exe
8/9/2020 - 0:46:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\
8/9/2020 - 0:46:43.668	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\
8/9/2020 - 0:46:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows
8/9/2020 - 0:46:43.668	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows
8/9/2020 - 0:46:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:43.668	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:43.668	Unknown	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:43.668	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\reg.exe
8/9/2020 - 0:46:43.668	Read	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\reg.exe
8/9/2020 - 0:46:43.668	Read	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\reg.exe
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\Prefetch\CMD.EXE-AC113AA8.pf
8/9/2020 - 0:46:43.731	Read	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\Prefetch\CMD.EXE-AC113AA8.pf	CMD.EXE-AC113AA8.pf
8/9/2020 - 0:46:43.731	Read	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\Prefetch\CMD.EXE-AC113AA8.pf	CMD.EXE-AC113AA8.pf
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	\Device\HarddiskVolume2
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\AppPatch
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\AppPatch
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\AppPatch
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\Globalization
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\Globalization
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\Globalization
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\Globalization\Sorting
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\Globalization\Sorting
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\Globalization\Sorting
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\Temp
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\Temp
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\Temp
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\ntdll.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\ntdll.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\wow64.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\wow64.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\wow64win.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\wow64win.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\wow64cpu.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\wow64cpu.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\kernel32.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\kernel32.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\kernel32.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\kernel32.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\user32.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\user32.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\ntdll.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\ntdll.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\apisetschema.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\apisetschema.dll	apisetschema.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\KernelBase.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\KernelBase.dll	KernelBase.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\locale.nls
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\locale.nls
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\msvcrt.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\msvcrt.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\winbrand.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\winbrand.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\user32.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\user32.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\gdi32.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\gdi32.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\lpk.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\lpk.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\usp10.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\usp10.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\advapi32.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\advapi32.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\sechost.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\sechost.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\rpcrt4.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\rpcrt4.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\sspicli.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\sspicli.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cryptbase.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cryptbase.dll	cryptbase.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\msctf.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\msctf.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\Globalization\Sorting\SortDefault.nls
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\Globalization\Sorting\SortDefault.nls	SortDefault.nls
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\apphelp.dll
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\apphelp.dll
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\BOOTSECT.EXE
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\AppPatch\sysmain.sdb
8/9/2020 - 0:46:43.731	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\AppPatch\sysmain.sdb
8/9/2020 - 0:46:43.731	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\Temp\TMP000000032EDF9B37C5E17B29
8/9/2020 - 0:46:43.747	Read	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
8/9/2020 - 0:46:43.747	Read	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\winbrand.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\locale.nls
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\Globalization\Sorting\SortDefault.nls	SortDefault.nls
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\AppPatch\sysmain.sdb
8/9/2020 - 0:46:43.747	Read	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\winbrand.dll
8/9/2020 - 0:46:43.747	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\BOOTSECT.EXE
8/9/2020 - 0:46:43.747	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\Temp\TMP000000032EDF9B37C5E17B29
8/9/2020 - 0:46:43.747	Read	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
8/9/2020 - 0:46:43.747	Read	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
8/9/2020 - 0:46:43.747	Read	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\winbrand.dll
8/9/2020 - 0:46:43.747	Read	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\winbrand.dll
8/9/2020 - 0:46:43.747	Read	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\winbrand.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\ntdll.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\wow64.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\wow64win.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\wow64cpu.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\kernel32.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\kernel32.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\user32.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\ntdll.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\apisetschema.dll	apisetschema.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\KernelBase.dll	KernelBase.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\msvcrt.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\user32.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\gdi32.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\lpk.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\usp10.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\advapi32.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\sechost.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\rpcrt4.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\sspicli.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cryptbase.dll	cryptbase.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\msctf.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\apphelp.dll
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	\Device\HarddiskVolume2
8/9/2020 - 0:46:43.747	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows
8/9/2020 - 0:46:43.747	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\wow64.dll
8/9/2020 - 0:46:43.747	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\wow64.dll
8/9/2020 - 0:46:43.747	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\wow64win.dll
8/9/2020 - 0:46:43.747	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\wow64win.dll
8/9/2020 - 0:46:43.747	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\wow64cpu.dll
8/9/2020 - 0:46:43.747	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\wow64cpu.dll
8/9/2020 - 0:46:43.747	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\System32\wow64log.dll
8/9/2020 - 0:46:43.747	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows
8/9/2020 - 0:46:43.747	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows
8/9/2020 - 0:46:43.747	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Monitor
8/9/2020 - 0:46:43.762	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\ui\SwDRM.dll
8/9/2020 - 0:46:43.840	Open	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows\Prefetch\REG.EXE-4978446A.pf
8/9/2020 - 0:46:43.840	Open	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows
8/9/2020 - 0:46:43.840	Open	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows\System32\wow64.dll
8/9/2020 - 0:46:43.840	Open	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows\System32\wow64.dll
8/9/2020 - 0:46:43.840	Open	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows\System32\wow64win.dll
8/9/2020 - 0:46:43.840	Open	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows\System32\wow64win.dll
8/9/2020 - 0:46:43.840	Open	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows\System32\wow64cpu.dll
8/9/2020 - 0:46:43.840	Open	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows\System32\wow64cpu.dll
8/9/2020 - 0:46:43.840	Open	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows\System32\wow64log.dll
8/9/2020 - 0:46:43.840	Open	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows
8/9/2020 - 0:46:43.840	Unknown	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows
8/9/2020 - 0:46:43.840	Open	1592	C:\Windows\SysWOW64\reg.exe	C:\Monitor
8/9/2020 - 0:46:44.28	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\winbrand.dll
8/9/2020 - 0:46:44.28	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\winbrand.dll
8/9/2020 - 0:46:44.28	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\sechost.dll
8/9/2020 - 0:46:44.28	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\sechost.dll
8/9/2020 - 0:46:44.28	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:46:44.28	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:46:44.28	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:46:44.28	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:46:44.28	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:46:44.28	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:46:44.28	Read	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\cmd.exe
8/9/2020 - 0:46:44.28	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Monitor
8/9/2020 - 0:46:44.28	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Monitor
8/9/2020 - 0:46:44.28	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\
8/9/2020 - 0:46:44.28	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\
8/9/2020 - 0:46:44.28	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Monitor
8/9/2020 - 0:46:44.28	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Monitor
8/9/2020 - 0:46:44.28	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Monitor
8/9/2020 - 0:46:44.28	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Monitor
8/9/2020 - 0:46:44.28	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Monitor
8/9/2020 - 0:46:44.28	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Monitor
8/9/2020 - 0:46:44.28	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:44.28	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:44.28	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:44.28	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:44.28	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:44.28	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:44.28	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\Globalization\Sorting\SortDefault.nls
8/9/2020 - 0:46:44.28	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\Globalization\Sorting\SortDefault.nls	SortDefault.nls
8/9/2020 - 0:46:44.28	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Monitor
8/9/2020 - 0:46:44.28	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Monitor
8/9/2020 - 0:46:44.28	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\schtasks.exe
8/9/2020 - 0:46:44.43	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\apphelp.dll
8/9/2020 - 0:46:44.43	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\apphelp.dll
8/9/2020 - 0:46:44.43	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\AppPatch\sysmain.sdb
8/9/2020 - 0:46:44.43	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:44.43	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:44.43	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\schtasks.exe
8/9/2020 - 0:46:44.43	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\
8/9/2020 - 0:46:44.43	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\
8/9/2020 - 0:46:44.43	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows
8/9/2020 - 0:46:44.43	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows
8/9/2020 - 0:46:44.43	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:44.43	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:44.43	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:44.43	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64
8/9/2020 - 0:46:44.43	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\schtasks.exe
8/9/2020 - 0:46:44.43	Read	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\schtasks.exe
8/9/2020 - 0:46:44.43	Read	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\schtasks.exe
8/9/2020 - 0:46:44.43	Open	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows\SysWOW64\sechost.dll
8/9/2020 - 0:46:44.43	Open	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows\SysWOW64\sechost.dll
8/9/2020 - 0:46:44.43	Open	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows\SysWOW64\ui\SwDRM.dll
8/9/2020 - 0:46:44.59	Open	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:46:44.59	Open	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:46:44.59	Open	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:46:44.59	Open	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:46:44.59	Open	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:46:44.59	Open	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:46:44.59	Open	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows\Globalization\Sorting\SortDefault.nls
8/9/2020 - 0:46:44.59	Unknown	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows\Globalization\Sorting\SortDefault.nls	SortDefault.nls
8/9/2020 - 0:46:44.59	Open	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows\SysWOW64\pt-BR\KernelBase.dll.mui
8/9/2020 - 0:46:44.59	Unknown	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows
8/9/2020 - 0:46:44.59	Unknown	1592	C:\Windows\SysWOW64\reg.exe	C:\Monitor
8/9/2020 - 0:46:44.59	Unknown	1592	C:\Windows\SysWOW64\reg.exe	C:\Windows\SysWOW64\pt-BR\KernelBase.dll.mui	KernelBase.dll.mui
8/9/2020 - 0:46:44.59	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\Prefetch\SCHTASKS.EXE-AD598958.pf
8/9/2020 - 0:46:44.59	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows
8/9/2020 - 0:46:44.59	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\System32\wow64.dll
8/9/2020 - 0:46:44.59	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\System32\wow64.dll
8/9/2020 - 0:46:44.59	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\System32\wow64win.dll
8/9/2020 - 0:46:44.59	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\System32\wow64win.dll
8/9/2020 - 0:46:44.59	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\System32\wow64cpu.dll
8/9/2020 - 0:46:44.59	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\System32\wow64cpu.dll
8/9/2020 - 0:46:44.59	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\System32\wow64log.dll
8/9/2020 - 0:46:44.59	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows
8/9/2020 - 0:46:44.59	Unknown	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows
8/9/2020 - 0:46:44.59	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Monitor
8/9/2020 - 0:46:44.75	Read	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\schtasks.exe
8/9/2020 - 0:46:44.75	Read	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\schtasks.exe
8/9/2020 - 0:46:44.75	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\sechost.dll
8/9/2020 - 0:46:44.75	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\sechost.dll
8/9/2020 - 0:46:44.75	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\ktmw32.dll
8/9/2020 - 0:46:44.75	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\ktmw32.dll
8/9/2020 - 0:46:44.90	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:46:44.90	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:46:44.90	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:46:44.90	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:46:44.90	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:46:44.90	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\imm32.dll
8/9/2020 - 0:46:44.90	Read	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\schtasks.exe
8/9/2020 - 0:46:44.90	Read	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\schtasks.exe
8/9/2020 - 0:46:44.153	Read	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\schtasks.exe
8/9/2020 - 0:46:44.153	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\version.dll
8/9/2020 - 0:46:44.153	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\version.dll
8/9/2020 - 0:46:44.153	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\schtasks.exe
8/9/2020 - 0:46:44.153	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\schtasks.exe
8/9/2020 - 0:46:44.153	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\Globalization\Sorting\SortDefault.nls
8/9/2020 - 0:46:44.153	Unknown	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\Globalization\Sorting\SortDefault.nls	SortDefault.nls
8/9/2020 - 0:46:44.153	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\schtasks.exe
8/9/2020 - 0:46:44.153	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\schtasks.exe
8/9/2020 - 0:46:44.153	Read	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\schtasks.exe
8/9/2020 - 0:46:44.153	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\rpcss.dll
8/9/2020 - 0:46:44.153	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\rpcss.dll
8/9/2020 - 0:46:44.153	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\uxtheme.dll
8/9/2020 - 0:46:44.153	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\uxtheme.dll
8/9/2020 - 0:46:44.340	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\taskschd.dll
8/9/2020 - 0:46:44.340	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\taskschd.dll
8/9/2020 - 0:46:44.434	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\xmllite.dll
8/9/2020 - 0:46:44.434	Open	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows\SysWOW64\xmllite.dll
8/9/2020 - 0:46:45.981	Unknown	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Windows
8/9/2020 - 0:46:45.981	Unknown	3032	C:\Windows\SysWOW64\schtasks.exe	C:\Monitor
8/9/2020 - 0:46:46.28	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Windows
8/9/2020 - 0:46:46.28	Unknown	1528	C:\Windows\SysWOW64\cmd.exe	C:\Monitor
8/9/2020 - 0:47:14.215	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local\Temp\cred.dll
8/9/2020 - 0:47:56.340	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\netprofm.dll
8/9/2020 - 0:47:56.340	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\netprofm.dll
8/9/2020 - 0:47:56.340	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\nlaapi.dll
8/9/2020 - 0:47:56.340	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\nlaapi.dll
8/9/2020 - 0:47:56.528	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\npmproxy.dll
8/9/2020 - 0:47:56.528	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\npmproxy.dll
8/9/2020 - 0:47:57.700	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\wininet.dll
8/9/2020 - 0:47:57.700	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Windows\SysWOW64\wininet.dll
8/9/2020 - 0:47:59.309	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local\Temp\cred.dll
8/9/2020 - 0:48:44.418	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local\Temp\cred.dll
8/9/2020 - 0:49:29.622	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local\Temp\cred.dll
8/9/2020 - 0:49:29.622	Open	1820	C:\ProgramData\1321ba6d1f\bdif.exe	C:\Users\Behemot\AppData\Local\Temp\scr.dll

Process

Trace

8/9/2020 - 0:45:43.262	Create	1480	C:\malware.exe	1820	C:\ProgramData\1321ba6d1f\bdif.exe
8/9/2020 - 0:46:43.653	Create	1820	C:\ProgramData\1321ba6d1f\bdif.exe	1528	C:\Windows\SysWOW64\cmd.exe
8/9/2020 - 0:46:43.668	Create	1820	C:\ProgramData\1321ba6d1f\bdif.exe	1592	C:\Windows\SysWOW64\reg.exe
8/9/2020 - 0:46:44.43	Create	1528	C:\Windows\SysWOW64\cmd.exe	3032	C:\Windows\SysWOW64\schtasks.exe
8/9/2020 - 0:46:44.59	Terminate	1820	C:\ProgramData\1321ba6d1f\bdif.exe	1592	C:\Windows\SysWOW64\reg.exe
8/9/2020 - 0:46:45.981	Terminate	1528	C:\Windows\SysWOW64\cmd.exe	3032	C:\Windows\SysWOW64\schtasks.exe
8/9/2020 - 0:46:46.28	Terminate	1820	C:\ProgramData\1321ba6d1f\bdif.exe	1528	C:\Windows\SysWOW64\cmd.exe

Analysis

Reason

Timeout

Status

Sucessfully Executed

Results

Registry

Trace

8/9/2020 - 0:45:43.481	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	ProxyBypass
8/9/2020 - 0:45:43.481	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	IntranetName
8/9/2020 - 0:45:43.481	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	UNCAsIntranet
8/9/2020 - 0:45:43.481	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	AutoDetect
8/9/2020 - 0:45:43.481	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	ProxyBypass
8/9/2020 - 0:45:43.481	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	IntranetName
8/9/2020 - 0:45:43.481	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	UNCAsIntranet
8/9/2020 - 0:45:43.481	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	AutoDetect
8/9/2020 - 0:45:43.481	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ProxyEnable
8/9/2020 - 0:45:43.481	Delete	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ProxyServer
8/9/2020 - 0:45:43.481	Delete	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ProxyOverride
8/9/2020 - 0:45:43.481	Delete	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings	AutoConfigURL
8/9/2020 - 0:45:43.481	Delete	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings	AutoDetect
8/9/2020 - 0:45:43.481	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SavedLegacySettings
8/9/2020 - 0:45:43.543	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content	CachePrefix
8/9/2020 - 0:45:43.543	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies	CachePrefix
8/9/2020 - 0:45:43.543	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History	CachePrefix
8/9/2020 - 0:45:43.778	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDecisionReason
8/9/2020 - 0:45:43.778	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDecisionTime
8/9/2020 - 0:45:43.778	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDecision
8/9/2020 - 0:45:43.778	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDetectedUrl
8/9/2020 - 0:45:45.90	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8C667F4-C62D-460A-82E2-EC8687C3DC60}	WpadDecisionReason
8/9/2020 - 0:45:45.90	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8C667F4-C62D-460A-82E2-EC8687C3DC60}	WpadDecisionTime
8/9/2020 - 0:45:45.90	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8C667F4-C62D-460A-82E2-EC8687C3DC60}	WpadDecision
8/9/2020 - 0:45:45.90	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8C667F4-C62D-460A-82E2-EC8687C3DC60}	WpadNetworkName
8/9/2020 - 0:45:45.90	Delete	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8C667F4-C62D-460A-82E2-EC8687C3DC60}	WpadDetectedUrl
8/9/2020 - 0:45:45.90	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDecisionReason
8/9/2020 - 0:45:45.90	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDecisionTime
8/9/2020 - 0:45:45.90	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDecision
8/9/2020 - 0:45:45.90	Delete	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDetectedUrl
8/9/2020 - 0:45:45.90	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDecisionReason
8/9/2020 - 0:45:45.90	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDecisionTime
8/9/2020 - 0:45:45.90	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDecision
8/9/2020 - 0:45:45.90	Delete	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDetectedUrl
8/9/2020 - 0:46:44.59	Write	1592	C:\Windows\SysWOW64\reg.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Startup
8/9/2020 - 0:47:56.528	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDecisionReason
8/9/2020 - 0:47:56.528	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDecisionTime
8/9/2020 - 0:47:56.528	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDecision
8/9/2020 - 0:47:56.528	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDetectedUrl
8/9/2020 - 0:47:57.856	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8C667F4-C62D-460A-82E2-EC8687C3DC60}	WpadDecisionReason
8/9/2020 - 0:47:57.856	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8C667F4-C62D-460A-82E2-EC8687C3DC60}	WpadDecisionTime
8/9/2020 - 0:47:57.856	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8C667F4-C62D-460A-82E2-EC8687C3DC60}	WpadDecision
8/9/2020 - 0:47:57.856	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8C667F4-C62D-460A-82E2-EC8687C3DC60}	WpadNetworkName
8/9/2020 - 0:47:57.856	Delete	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8C667F4-C62D-460A-82E2-EC8687C3DC60}	WpadDetectedUrl
8/9/2020 - 0:47:57.856	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDecisionReason
8/9/2020 - 0:47:57.856	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDecisionTime
8/9/2020 - 0:47:57.856	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDecision
8/9/2020 - 0:47:57.856	Delete	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDetectedUrl
8/9/2020 - 0:47:57.856	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDecisionReason
8/9/2020 - 0:47:57.856	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDecisionTime
8/9/2020 - 0:47:57.856	Write	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDecision
8/9/2020 - 0:47:57.856	Delete	1820	C:\ProgramData\1321ba6d1f\bdif.exe	HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3	WpadDetectedUrl

File Summary

Created

Identified: True

Deleted

Identified: False

Process Summary

Created

Identified: True

Deleted

Identified: True

Registry Summary

Proxy

Identified: False

AutoRun

Identified: False

Created

Identified: True

Deleted

Identified: True

Browsers

Identified: False

Internet

Identified: True

Loading...

DNS

Query

Response

TCP

Info

localhost:65193 217.8.117.52:80
localhost:65191 217.8.117.52:80
localhost:65199 217.8.117.52:80
localhost:65201 217.8.117.52:80
localhost:65192 217.8.117.52:80
localhost:65198 217.8.117.52:80
localhost:65194 217.8.117.52:80
localhost:65197 217.8.117.52:80
localhost:65200 217.8.117.52:80
localhost:65195 217.8.117.52:80
localhost:65196 217.8.117.52:80

UDP

Info

localhost:68 255.255.255.255:67
localhost:67 localhost:68

HTTP

Info

Summary

DNS

False

TCP

True

UDP

True

HTTP

False

Results

BINARY

NFS 2.0 (Threshold = 0.8)

confidence: 55.00%
suspicious: True

Decision Tree (NFS-BRMalware)

confidence: 100.00%
suspicious: True

MalConv (Ember: Raw Bytes, Threshold=0.5)

confidence: 97.13%
suspicious: True

Random Forest (100 estimators, NFS-BRMalware)

confidence: 78.00%
suspicious: False

Non-Negative MalConv (Ember: Raw Bytes, Threshold=0.35)

confidence: 49.73%
suspicious: True

LightGDM (Ember: File Characteristics, Threshold=0.8336)

confidence: 90.35%
suspicious: True

Back

Report #11149 check_circle

Binary

Hashes

Community

YARA

Strings

Foremost

Heuristics

PEDetector

Disassembly

AVclass

VirusTotal

File

Process

Analysis

Registry

File Summary

Process Summary

Registry Summary

Loading...

DNS

TCP

UDP

HTTP

Summary

Results

Report #11149