lkptrend.blogg.se

9990907617 1įile created: C:\Program Data\Micro soft\Searc h\Data\App lications\ Windows\ed b00007.jtx. 9958376886 1įile created: C:\Program Data\Micro soft\SmsRo uter\Messa geStore\Sm sIntercept Store.db.i d-933BF3C5. 9921665469 3įile created: C:\Program Data\USOSh ared\Logs\ NotifyIcon. credo entr opy: 7.999 70722467įile created: C:\Program Data\Micro soft\Windo ws Defende r\Scans\mp enginedb.d b.id-933BF 3C5.cred o entropy: 7.9996555 2224įile created: C:\Program Data\USOSh ared\Logs\ Notificati onUxBroker. 9971801558 5įile created: C:\Program Data\Micro soft\User Account Pi ctures\gue st.bmp.id- 933BF3C5.credo ent ropy: 7.99 971331318įile created: C:\Program Data\Micro soft\Windo ws\DeviceM etadataCac he\dmrc.id x.id-933BF 3C5.cred o entropy: 7.9997243 3628įile created: C:\Program Data\Micro soft\User Account Pi ctures\use r.bmp.id-9 33BF3C5.

id-933BF3 C5.credo entropy: 7.99739041 024įile created: C:\Program Data\Micro soft\SmsRo uter\Messa geStore\ed d-933BF3C5. credo entr opy: 7.997 12541966įile created: C:\Program Data\Micro soft\SmsRo uter\Messa geStore\ed b00001.log. 999874542 65įile created: C:\Program Data\Micro soft\SmsRo uter\Messa geStore\ed b.log.id-9 33BF3C5.

999846545 04įile created: C:\Program Data\Micro soft\Netwo rk\Downloa der\edbres 00001.jrs. log.id-93 3BF3C5.c redo entro py: 7.9998 7537559įile created: C:\Program Data\Micro soft\Netwo rk\Downloa der\edbres 00002.jrs. credo entr opy: 7.999 58249485įile created: C:\Program Data\Micro soft\Netwo rk\Downloa der\edbtmp. May disable shadow drive data (uses vssadmin)įile created: C:\Program Data\Adobe \Setup\\setu p.exe.id-9 33BF3C5. Source: vssadmin.e xe, 000000 05.0000000 2.46848569 2.000001BB 6D100000.0 0000002.00 000001.sdm pīinary or memory string: Exampl e Usage: vssadmin D elete Shad owStorageīinary or memory string: Exampl e Usage: v ssadmin De lete Shado ws /Type=C lientAcces sible /For =C:īinary or memory string: v ssadmin De lete Shado wsīinary or memory string: Exampl e Usage: vssadmin D elete Shad ows /For=C : /Oldestīinary or memory string: Exampl e Usage: vssadmin D elete Shad owStorage /For=C: /O n=D: exevssadm in delete shadows / all /quiet vssadmin delete sha dows /all /quietWinS ta0\Defaul tīinary or memory string: vssadmin delete sha dows /all /quiet Process created: C:\Windows \System32\ vssadmin.e xe vssadmi n delete shadows /a ll /quiet unpack, t ype: UNPAC KEDPEĭeletes shadow drive data (may be related to ransomware) Multi AV Scanner detection for submitted fileĪntivirus or Machine Learning detection for unpacked fileįile source: Process Me mory Space : fss.exe PID: 5348, type: MEM ORYįile source: Process Me mory Space : fss.exe PID: 2904, type: MEM ORYįile source: C:\Program Data\Micro soft\Windo ws\Start M enu\Progra ms\StartUp \fss.exe, type: DROP PEDįile source: 11.2.fss.e xe.400000. Source: C:\Program Data\Micro soft\Windo ws\Start M enu\Progra ms\StartUp \fss.exe Multi AV Scanner detection for dropped file Antivirus / Scanner detection for submitted sample