Eventi
Suspicious mail: Hi dannyevil_invoice.docx created by Derre Hendrikevil_invoice.docx modified by Derre HendrikMail: invoice for payment with download link evil_invoice.docxSystem boot and logon: UserSaved CompanySecrets.docxCreated MyPaintingSkills.pngChrome: https://officehustler.beSystem reboot and logon: UserOpened CompanySecrets.docxChrome: https://www.officehustler.be/oh-db-management/Outlook: added new mail accountOpened evil_invoice.docxClosed OutlookOpened You_Have_Been_Hacked.txtDeleted MyPaintingSkills.png and folder CatPicturesService created 'myjob' and download of evil.exeUser account 'pwned' createdAutostart Remote Desktop ServicesLogon: pwnedCreated: You_Have_Been_Hacked.txtRemote desktop session disconnected: pwnedLogoff: UserLogon:UserSystem power off
Comments